From the ISPs perspective, companies are still just as responsible for whatever takes place over their connection. From the law's perspective, the person responsible is whoever a jury can be convinced did it.

In cases where the company wifi is open or places like hotels the person who did it could be long gone. Unsecured residential wifi connections aren't much of a thing anymore, but I've seen a lot of people lending out their residential connection when they airbnb their vacation homes to strangers.