The argument is, according to the OP, that the entity responsible for designing/administering/maintaining software services/software/IT systems is liable. But it seems like they would like to punish the employer, and not the employees.