But I also think this is an extreme example of a much more general problem of provenance.
There are a lot of people vibe-coding apps who lack the “basic” skills needed to do this due diligence at even the coarsest level that we arguably see here (not making any comment either way on this specific author).
Does that get them off the hook? I don’t think so. They’ve created a thing and they are naturally responsible for whether or not that thing involves theft or appropriation of IP from other sources.
It’s an “ignorance is not an excuse” kind of thing.
This scales all the way up to agentic development in large organisations, but it also becomes much more granular and subtle, which is perhaps where it becomes more interesting - and certainly a lot more challenging. Where has that chunk of code come from? How do you know where it’s come from? Is there even a feasible way of finding out?