Yes, a better framing might be that they were negligent in not preventing the attack on a third-party.

They didn't explicitly instruct an attack to happen, but they should have done a hell of a lot more to prevent it from happening.