It would be an awful precedent if you're not liable for crimes your agent commits, even when you've been clearly lax about security.
It would mean you could effectively legally run a cyber crime gang by turning a blind eye and maitaining plausible deniability