No matter who writes the code, the name in the commit is responsible as well as the person who approved / reviewed the PR.
Why didn't testing catch this? Why was there no canary? How come alarms didn't wake up an on call as soon as the call-volume on the backend dropped? Why was this update rolled out to every customer at once, instead of gradually?
Users who will forget about it, and due to inertia stay on your platform.
i've also heard "the prompt is the only thing that should be reviewed"