Or the marketing person who created / managed an Instagram campaign?

Or the IT staff who setup notebooks and a VPN/firewall?

None of these (or many others) was even involved in the core product or are expected to know anything about financial regulations.

There is a reason that usually only senor leadership is involved in such suits.

There are exceptions to that rule of course