Handcuffs yes, but you would be charged with criminal negligence at best. Plenty of people don't secure their networks properly and hackers use them in botnets to attack others. The blame would be on hacker, not the provider of hacked device.

In case od LLMs, the reasoning is that it is a security flaw. But in this case, the party that operates the service is not the one that suffers the consequences of such security bug.

But either way you wouldn't put people in jail for having security flaws in their software.

I know this will be unpopular opinion, but it makes logical sense.

The huggingface should be compensated, OpenAI investigated, but unless there is proven negligence like disabling sandboxes or intentionally designing AI to push through them, no one should be liable in other way than monetary.

Accidents happen but we shouldn't be close minded. Chernobyl negligence wasn't reason to abandon nuclear power.