Obviously Bitfinex is the one to blame here. But isn't BitGo's security model weak then too?

If BitGo held the 2nd key but was fooled to sign off on all these transactions then they're not adding much value here, are they?According to Zane, the 3rd offline key wasn't used http://bit.ly/2ajUguo: clarity via /r/Bitcoin http://bit.ly/2awfIjm