Choosing a supplier is not washing hands of the issue, if you are a serious business. If you are found to not have done due diligence and have chosen a known

Choosing a supplier is not washing hands of the issue, if you are a serious business. If you are found to not have done due diligence and have chosen a known vulnerable supplier, you would be seen as equally or more liable compared to having yourself implemented a solution that was found vulnerable. In fact, I imagine your customers can sue you in the former instance and likely win more easily than in the latter (IANAL).