To me, the issue is Lovable’s borderline reckless marketing: repeatedly claiming that “everyone” can build a website “without any technical knowledge” (verbatim from their website), while disclaiming all liability for bugs in their terms and placing responsibility for security on their customers.
Customers who hear day in, day out that “software is solved” and buy into Lovable’s narrative may simply have no idea that they could face substantial fines for privacy violations.
But in all cases, under GDPR, the one having the data breach is required to act. If they fail, there's steep fines, often proportional to your revenue. It will hurt the business.
E.g. here's what a ditch citizen can do and expect https://www.autoriteitpersoonsgegevens.nl/en/themes/security...
IANAL, but I've had several hosting companies. And while most situations where a customers' site is hacked and/or their data leaked, is clear and not the hosters' responsibility. That hoster does have an obligation to provide good tooling (i.e. ssh, not telnet, sftp, not ftp) and to promote good behaviour (i.e. not allowing the backup system to write the backups to public hosted directories). Or else can be held (partially) responsible for breaches.
Lovable has a responsibility, and, as you pointed out in your article, their proposition of "building apps without technical knowledge" (my words), might make theirs to be more than just putting lines in a EULA to waver that responsibility.