I do agree that Starbucks share responsibility but would you really say that 0% of the responsibility is with the person or people who actually set up the mining?
So you're saying never to trust 3rd party providers? It's one for the legal team I'd say; in this case Starbucks probably didn't provision for abuse or time spent in the wifi portal in the contracts. Might have a case for causing reputation damage.
If it were my business I'd absolutely say that. Doesn't mean you shouldn't USE 3rd party providers but you should be very careful. That's obviously not saying anything about legal responsibilities, of which I know nothing about.