I have no problem with attaching penalties, perhaps even criminal ones, to negligence on the part of people deploying apps, too. I don't see why it has to be one or the other.

Incidentally: I have literally no opinion about the Auernheimer case, so don't read anything into these comments.