blame/responsibility is a red herring here. mugging is already illegal and, if caught, the perpetrator faces imprisonment. the salient question to ask here is what changes we can make to reduce the unwanted behavior.
possible actions:
politely ask the general public not to mug one another
increase penalties or rate of apprehension for perpetrators
encourage people to minimize their ATM visits, not walk around with debit cards, etc.
give people money so they don't feel the need to mug other people
You're right, "blame" is too loaded of a word, and also inadequate. However, in order to identify the actions to take, you still need something like a full systems analysis of weak points. Your list is a pretty good start on representing those.
We don't say that an ATM mugging victim bears some responsibility just because a criminal knows that such people will almost always pay out.