It's a bit like the idea of the additional responsibility/burden of the publisher of a newspaper.
"So we can sue them when our customers get angry"
You can either target systemic problems or chop of some heads to cool off the masses- and quickly go back to work.
It's like saying "developers should be responsible for their own security so we will make them liable if a random node dependency in the application they are building gets pwned"
Firstly, liability and security are different things.
Employees should never be liable for something that happens if they are using a work-supplied tool at work in the manner in which it is designed to be used.
Secondly, it's just lazy thinking to say "oh it's hard therefore we'll make the human sorely responsible".
There are many things that can help - sandboxing, adversarial LLM inspection of prompts, separation of security contexts etc. Yes they are hard and might need new primitives.
Architects and properly-designated publishers both have long liability that is actually independent of their employment.
In significant cases, the way you provoke companies to do the right thing (security, sticking to the facts, not cutting corners in building plans) is to make someone responsible if they don't.
That person takes on a job, does the job, and is rewarded properly for the job.
A news organisation's liability for AI hallucination falls on the same person that the liability for printing a lie does: the publisher.
In my opinion all AI use companies should be attached to a specific employee, and that person is liable and so is the company of course for the actions of the AI