Or to put it another way, lack of IT security allowed a weak password to be used.

The company said they didn’t want to let the person with the weak password now that was how the company was infiltrated.

I’d suggest that the company hadn’t mandated first level security hardening. No need to “not” blame an employee.