My comment specifically implied holding the company liable and responsible...

Legally, for "the company" to engage in hacking someone on payroll would've had to intentionally instruct it to do so.

This is an airtight case for gross/criminal negligence, as the company publicly advertises the dangers of these tools, and their capability to be weaponised in cybersecurity, while choosing to operate with extremely lax sandboxing and isolation.