It's the wrong question, because apportioning blame doesn't return coins.

How can the user be at fault when they have the option to let the device generate the seed phrase? Otherwise don’t have an option and force the dice rolls. lol everybody preached cold cards are secure get your bitcoin off exchanges. All that trust gone.

Unfortunately both. But to be fair the users were deceived. Yet, shouldn't have trusted in the first place. Very very tough lesson, many of us can count ourselves lucky as it could have happened to us too. Live and learn.