Anyone can be sued. But it wouldn't be a good idea if they kept the receipts:
https://www.reddit.com/r/sysadmin/comments/ma4mwl/the_absolu...
> We tried really hard to make management aware and actually succeeded in that, only for management to follow up and say we don't have enough money to fix it, and they understood the possible outcomes.