I disagree that this automatically means the OP tried to buy gil, blanket statements like that are rarely ever a good idea to use in constructive discussion, but I also fail to see the issue people have with SE over this situation. Their responsibility for your account security stops at their servers that have your info on them.
If someone gets ahold of your username and password by any means other than hacking into SE's system, that's more or less on you. If anything, the fault lies with the 'hacker' in this example by choosing to commit the action in the first place, but if a website can have an embedded keylogger on it, it stands to reason it's possible to pair that info with the IP you connected to that site from, and spoof it when logging into your game account.
If SE's own security becomes compromised, then sure, it's on them. But until that announcement is made, I'd assume they have plenty of people phoning in for CS, and since they've already provided two different means of accessing a way to increase your account's security, hacked accounts aren't going to be bumped up the waiting list.