I think positing a nation-state is an unnecessary complication.
Let's imagine two different bank robberies, carried out by the same wicked bank robbers.
In the first, the bank robbers steal a bulldozer and a crate of dynamite, knock down half the bank in the middle of the night, blow the safe, and run away with the money.
In the second, the bank has left the safe and all the doors unlocked at the end of the day when everyone goes home. The robbers stroll in through the open door, take the money, and casually walk away.
In both situations, the robbers are fully culpable. They don't get a pass just because the money was left lying around where anyone could take it. They should be pursued and an appropriate punishment (or rehabilitation, if that's your thing) should be meted out in either case. But in the second scenario, the bank is also culpable - they failed to take reasonable precautions, they were negligent in their duties.
If someone is negligent in their duties and that negligence results in harm to others, they should be held responsible for it. The situation doesn't change if it was a nation-state that took advantage of the negligence; the hypothetical bank aren't being punished for being robbed, and it doesn't matter that a hypothetical determined robber could still have broken through nearly any security you could imagine, they were still negligent in their duties.