Yes, the commercial entity backing the ML program, and possibly multiple associated entities would be held responsible, or at least dragged into litigation. You can get insurance companies to write custom policies for such things, but I dont think there has yet been a standards-setting case -- anyone know of existing or in-progress case law in this arena?

Most likely all these models have TOS or EULAs which shift liability in such situations.