The CEO can’t be held personally liable for the actions of the company, for example; their underlings could have been responsible and kept the leader in the dark.

The onus should be on the company to prove their employees kept the CEO in the dark, not the other way around.

That is a tricky question. IT isn't just does the CEO know, but should the CEO have known. If you make a machine that injures people the courts ask should you have expected that.

The first time someone uses a lawnmower the cut a hedge the companies and gets hurt can say "we never expected someone to be that stupid" - but we now know people do such stupid things and so if you make a lawn mower and someone uses it to cut a hedge the courts will ask why you didn't stop them - the response is then we can't think of how to stop them but look at the warnings we put on.

When Grok was first used to make porn X can get by with "we didn't think of that". However this is now known. They now need to do more to stop it. there are a number of options. Best is fix Grok so it can't do that; they could also just collect enough information on users that when it happens the police can arrest the person who instructed grok. There are a number of other options, if the court accepts them depends on if the tool is otherwise useful and if whatever they do reduces the amount of porn (or whatever evil) that gets through - perfection isn't needed but it needs to get close.