I don't know about legal responsibility, but this happened because the driver was working for Uber. Uber knew who the carjacker was before it happened, and they directed the driver to the carjacking.
This wouldn't have happened without Uber's involvement, and Uber is uniquely situated to be able to prevent this type of carjacking. If they're not responsible for the costs of their safety decisions, they should be.