If you are found to not have done due diligence and have chosen a known vulnerable supplier, you would be seen as equally or more liable compared to having yourself implemented a solution that was found vulnerable.

In fact, I imagine your customers can sue you in the former instance and likely win more easily than in the latter (IANAL).