This is a useless statement.

It's like saying "developers should be responsible for their own security so we will make them liable if a random node dependency in the application they are building gets pwned"

Firstly, liability and security are different things.

Employees should never be liable for something that happens if they are using a work-supplied tool at work in the manner in which it is designed to be used.

Secondly, it's just lazy thinking to say "oh it's hard therefore we'll make the human sorely responsible".

There are many things that can help - sandboxing, adversarial LLM inspection of prompts, separation of security contexts etc. Yes they are hard and might need new primitives.

I have come to this conclusion myself.

It's a bit like the idea of the additional responsibility/burden of the publisher of a newspaper.

A particular c suite employee. Each company having a low level sacrificial goat doesn't solve anything. They must be responsible but also be in charge.

"why hire humans?

"So we can sue them when our customers get angry"