And you can just wash hands because you used "industry's best practice" and continue the security theatre.
If you are found to not have done due diligence and have chosen a known vulnerable supplier, you would be seen as equally or more liable compared to having yourself implemented a solution that was found vulnerable.
In fact, I imagine your customers can sue you in the former instance and likely win more easily than in the latter (IANAL).