Where do you draw the line, and where does someone take final responsibility? I don't have an issue with allowing AI to do everything with limited to no human verification for hobby projects. I have an issue with allowing AI to write and ship medical device software with no human review. What's the middle ground?

You still take the full responsibility, I don't think leveraging AI reviews removes any layer of responsibility. The challenge is building the feedback loop (or the agent that builds the feedback loop) to make the review process actually catch what it needs to catch.