Where is the responsibility of the investor? AAA ratings are not endorsements. The ratings (and rating agencies) exist to constrain the behavior of the buy side. Pension funds, insurance companies etc. are limited by laws and covenants to limit their exposure to non-investment grade securities.
The models the rating agencies were using were not secret. They defined to a great extent what was allowed to go into a pool, and how much support and credit enhancement would be necessary for the senior tranche to get a AAA rating. So as a pension fund manager, if I see to pieces of AAA paper of similar maturity trading at radically different yields, I have to consider am I getting a deal, or does the smart money know something about one of these deals? And honestly if I just buy in bulk, relying on the rating alone without due diligence on the deals, shouldn't I bear some responsibility?
Beyond that, it's not clear that you could prove civil liability. The ratings were based on models, and the models were based on historical experience (and some wishful thinking.) But when push comes to shove in the context of billion dollar lawsuits, you can imagine they'll tease the wishful thinking out of the models and show that their rating models, though flawed, were based on a reasonable interpretation of historical experience and that ratings are not an endorsement or a guarantee of suitability.
As someone who witnessed the crisis up close, the ultimate cause of the crisis was a bunch of ordinary people, both on Main street and on Wall Street, making good faith decisions that seemed rational at the time, but in retrospect proved to be idiotic.