Perhaps they should have, but then to some extent this is a wider issue than taking the photographs -- the time is ripe for a second layer of security along with a password, for example, although what form this should take I'm not really in a position to be sure. For online banking my account uses a form of one-time pad security to log-in, which is a promising start, although this is instead of rather than as well as a password/ secret question.
At any rate, the issue is that security on the internet is not as high as some people think.* And it's this aspect of security that should be tackled, rather than the decision to take and store such photographs. They were clearly intended to be private, since there was a password to protect them. Criticising these people for taking the photographs is missing the point. And, anyway, wrong, because such photographs are just the latest form of celebrating/ enjoying sexual/ nude bodies and there's nothing wrong in taking or enjoying pictures like that.
As a second point I believe the iCloud is automated so it's possible that there was never even a conscious intention to have them online in the first place. Again, any and all criticism should be focused at the service and its level of security. Not the people taking photos.
*And sometimes we trust passwords too much. But then, even the experts get it wrong. Apparently Bradley Manning (as she then was) of the wikileaks documents leak in 2010 and an intelligence analyst, posted the information under the alias "bradass87". It didn't take too long to guess that the source of the leaks was someone named Brad, born in 1987...