IANAL, but I've had several hosting companies. And while most situations where a customers' site is hacked and/or their data leaked, the hoster does have an obligation to provide good tooling (i.e. ssh, not telnet) and to promote good behaviour (i.e. not allowing the backup system to write the backups to public hosted directories).

Lovable has a responsibility, and, as you pointed out in your article, their proposition of "building apps without technical knowledge" (my words), might make theirs to be more than just putting lines in a EULA to waver that responsibility.