I think there's a difference here.

The AI end user is using the tool as intended by the manufacturer: "Book me a yoga class". If the tool does something illegal/harmful it is the manufacturer's fault.

If the power hammer user uses the tool as intended but it explodes, it is the manufacturer's fault.

If the AI end user says "Hack the yoga website" or the power hammer user uses the tool to destroy something it's the end user's fault.

The way it normally works is that the user can be held liable, and then ask compensation to the manufacturer if there was some assurance or basic expectations.

The point is that the accountability sink can't be allowed to exist. It can't be a hot potato game, but it can be the fault of multiple people in the chain.

It's both (neither of these are legitimate defences):

I did not know that accessing a website using a SQL string would cause an injection that enabled me to take full admin of the site

and

We sold them a food laced with toxins, they should have known that it was poisonous