If responsibility is written and it says they produce unbreakable hardware, then yes.

If they don't do anything after finding out vulnerabilty - probably it depends, I dont know.

But thy are clearly putting in effort with vendors to mitigate and solve the issue. Doesn't look like negligence to me.