That's like saying "If the gun fires the bullet, who is liable for murder?" It's a silly question.
I don't know I've seen several people unironically argue that it should be the gun's manufacturer.
With software of course it is a little complicated because:
* it can be produced really easily in a distributed fashion over the internet by anonymous people in many jurisdictions, so there isn't always an obvious company or entity to sue
* most automation tools can be repurposed for malicious use (nobody would sue John Deere because their tractors can be armored and turned into pseudo-tank things)