The case which happened to the stake user is definitely the fault of the user and not stake, so I am going to disagree with you when you say it's the fault of both sides.
Stake have done their best in providing good security features for their users, Stake still can not be the one to turn on those security features for the user, a user is solely responsible for turning on any of the security features he or she feels he or she needs, and leave the ones he or she thinks is irrelevant to him or her, if a user having good amount of money on his or her stake account doesn't find it needful to turn on 2fa for the safety of their funds, then whatever happens that leads to the user losing those funds, that is clearly his or her fault and not the fault of the Casino.
It's true that the gambler messed up by not enabling 2FA which would saved him from this mess, but it's also true that he wouldn't have to go through this ordeal if Stake's security stopped the hacker in the first place.
The fact is that a Stake account got hacked despite the site being one of the top gambling sites these days which is embarassing to say the least.
Man, what exactly are you saying?
Now, I am going to say this before I proceed, I am not defending Stake, I don't want anybody to come around a start accusing me of defending stake possibly because I am wearing their signature ad, no, I will never support a casino doing wrong even if I am in their pay roll.
Now, with the above being out of the way, I would like to ask you, how would you have expected stake security to stop the hacker? Is it the security the user enabled or turned on, or the one he did not turn on? Oh, you expected stake to turn on automatically turn on the security for him right?
.
And speaking of the fact that an account on stake got hacked despite them being the top online gambling casino, and you think this is a shame on them, bud, thousands of binance users have been hacked in previous times, as well as other exchanges.
When it comes to security, you are your own security, all the platform owe you as a user is to provide you with all the security features they thing is useful for your account safety, it's up to you to use it, or ignore it.