@Jeffro - Based on the changed wording, then, the answer has to be that it is the end user's responsibility, because that is the factual truth, BUT I think a far more interesting question would be "In an ideal world, where should the responsibility lie?" and that would logically lead to a very different answer.

One of the big challenges that lies before WordPress, or any ambitious new project that overtakes WordPress, will be to put in place a distributed infrastructure that allows users to have their installations automatically upgraded as often as necessary, essentially extending something akin to the managed nature of WordPress.com to self-hosted WordPress installations. So, in an ideal world the responsibility would lie with WordPress (the project, not the dotcom).

This would, of course, be a truly complex engineering problem and I have no idea what the ultimate solution might look like but, sadly, it will have to be done at some point because the hackers are only getting better and, no matter how much people SHOULD upgrade, the reality is that a significant percentage of them do not. We have to deal with the world as it is, not as we would wish it to be.