I 100% agree with you. Atlassian is 100% responsible. I'm not sure I would not say they are at 'fault' though. Maybe I'm just quibbling over semantics.

I don't know the details of the vulnerability - I would say they were at fault if they did not update/patch a fixed vulnerability.