Was it the Microsoft store or not? If it was an MS store, then it's their fault. The store was branded with the MS brand in order to convey to consumers that the store could be trusted. That Microsoft contracted hosting/development out to a crappy firm is Microsoft's fault not the consumer-who-trusted-their-brand's fault. Users trusted that an Microsoft-branded domain would be kind. Fail.