This one rests squarely on Apple, as it was their auth service that contained the bug. While an application could potentially (not that I know exactly how in t

This one rests squarely on Apple, as it was their auth service that contained the bug. While an application could potentially (not that I know exactly how in this case) further verify the received token, that verification is exactly what an authentication service is supposed to provide, hence the responsibility absolutely rests on Apple who provides the service.