DHS has the Cybersecurity & Infrastructure Security Agency. Their job is to help organizations in the US with protecting public services and physical infrastructure. They are partially responsible for the outcomes.

https://www.cisa.gov/

> How is it NSA/DHS negligence? Neither is responsible for securing the infrastructure of state and local governments nor private companies.

It is not a duty nor their responsibility. It is however bad for nation overall if companies don't dedicate some resources to security, so a sane administration will do something to advocate for it.