No, not because they are a start up, but because it's really damn easy for $random_internet_user to get compromised and not realize it.

Did $random-user share his dropbox email with someone else who was compromised?

Did $random-user save his dropbox email on a large service (like Yahoo), which he had compromised?

Did $random-user not update Java, Adobe, Windows, etc and have his machine compromised? Or in some other way leak information?

I'm not in any way excusing Db, but uncritically blaming them without other possible scenarios seems just as asinine.

> I'm not in any way excusing Db, but uncritically blaming them without other possible scenarios seems just as asinine.

Except you're wrong here - they've admitted they leaked all these unique email addresses, and it isn't actually some cataclysmic combination of coincidences that all these users were compromised. As would otherwise need to be the case.