Obviously Bitfinex is the one to blame here. But isn't BitGo's security model weak then too?

Obviously Bitfinex is the one to blame here. But isn't BitGo's security model weak then too? (self.Bitcoin) If BitGo held the 2nd key but was fooled to sign off on all these transactions then they're not adding much value here, are they?