> I like Valve's approach. Who is the real bad guy here?

Valve are, leaving millions of users at risk, despite having been informed of an issue.