>Most often the business hires a security contractor to take care of it, and signs the contract without understanding the terms.

The bulk of the responsibility here would lie on whoever signed I think. It's one thing to click "I agree" when you are making a SaaS account for downloading cat videos. But at a job, you are getting paid to read these things and to make informed decisions.