I know this is the risk management answer, but when you're the featured story on the news because of a data breach, noone hears "butbutbut it's Anthropic/OpenAI/whoevers fault...". So it's a balance between "there's someone we can sue" and "what's our reputation worth".

It actually does help a lot to be able to say your OpenAI agent was the fault. People recognize the name. The press doesn't want to write about Better Home Life Insurance agents running loose on the internet, nobody cares.