I think there's a difference here.

The AI end user is using the tool as intended by the manufacturer: "Book me a yoga class". If the tool does something illegal/harmful it is the manufacturer's fault.

If the power hammer user uses the tool as intended but it explodes, it is the manufacturer's fault.

If the AI end user says "Hack the yoga website" or the power hammer user uses the tool to destroy something it's the end user's fault.