The company is still responsible for that, it doesn't mattter why. Do you think that consumer cares if the lack of PCI compliance caused them to have their CC

The company is still responsible for that, it doesn't mattter why. Do you think that consumer cares if the lack of PCI compliance caused them to have their CC information stolen and used because someone internally thought someone else was responsible for PCI compliance? If you choose to store CC information it's your responsibility to make sure you're PCI compliant, if you employ people, it's your responsibility to make sure they get paid.