I am sorry Pooh, but Blizzard has made clear for 20 years, that Account Security IS the responsibility of the account holder. Period. Always has been, always will be. If we players mess up, Blizzard will try to fix it, but that has never been guaranteed.
Reminding someone of the long standing policy is not “victim blaming”. They were not personally blaming them, the GM was reminding them of the longstanding policies. They did what they could within the circumstances and policy. The person did get their account access back - which is also not guaranteed.
From the EULA
Please take a few moments to review Blizzard’s Account Security information here. You must maintain the confidentiality of the Login Information, as you are responsible for all uses of the Login Information and the Account , including purchases, whether or not authorized by you. If you become aware of or reasonably suspect any breach of security, including without limitation any loss, theft, or unauthorized disclosure of the Login Information, you must immediately notify Blizzard through https://us.battle.net/support/en/.
Security of your account is your responsibility. For tips on keeping your account secure, visit our Account and Computer Security page.
Third-party User Interface addons are very popular in World of Warcraft. We are not responsible for damage that may occur from third-party addons.
Regaining Control of a Compromised Account
If you believe your account has been compromised, take the following steps:
We disable access to compromised accounts while we investigate. Once we are confident that account access has been restored to the registered user—and only the registered user—we will reenable access to the account.
While we will attempt to restore any items and gold missing from the account, we cannot guarantee that lost items or gold will be reimbursed.
Only you are allowed to access an account registered in your name. We don’t recognize the transfer of accounts between individuals. Activities performed on your account are your liability.
You may not share your account or password with anyone, except if you are a parent or guardian, in which case you may permit one minor child to use your account. You may not use your account at the same time, and you are liable for activities conducted by the minor child.
You are responsible for maintaining the confidentiality and the use of your user name and password. You are responsible for all uses of your information, even if you don’t authorize them. Security of your account is your responsibility.