Car manufacturers are required to do recalls on cars that have airbags that explode rather than inflate. Even 20 year old clunkers. They widely publicize cars they think aren't actually safe anymore so customers can choose to update.
When food is shipped out to customers full of listeria, they don't say "you should have kept a full pcr lab in the kitchen and tested every bite, this is obviously the eater's fault", they flood the news with recall notices and take the food back and offer a refund. (and often are still sued because they too have responsibility).
The firewall stopped doing it's job, if it had done it's job properly the device wouldn't have been owned. Why shouldn't firewall manufacturers be required to have some responsibility when the firewall is shown to not actually firewall?