Many avenues lead directly to the customer. Linksys used gpl code illegally and when they were found out they had to release updates across all of their products, causing some of their lines to be end-of-lifed earlier than expected. Customers are definitely impacted by that.

How about security secrets which directly impacts the customer?

The question wasn't how could the customer be impacted. None of those scenarios have to do with the customer being held legally liable for the IP violations of a vendor whose product they use.