I see this as a tricky question to answer. Like @rslade says, it is ultimately the end user who is responsible for securing it. If senior management hires someone, like an IT manager, and they do a poor job at securing these items, then it still is the senior manager's fault.
In America we are having similar questions about things other than infosec in this same realm. Some people think that they should be able to sue gun manufacturers because someone used their product in a manner than it was otherwise intended. Should the gun manufacturer have installed some more security measures so that the gun could not be misused? And you could swap out other industries instead of guns and you have the same argument. Can we sue alcohol manufacturers because someone got drunk and then drove their car and killed someone. Is the auto maker at fault for not designing an ignition lockout to test for drunk drivers? Can we sue phone makers or cell phone service providers because someone was distracted and crashed their car and hurt or killed someone. Baseball bats, ropes, crowbars, rat poison, etc. have all been used for purposes other than what they were intended. We can point out that these items can use some more security or laws around their use, and we have created lots of laws or put in to place other countermeasures to try and restrict the "weaknesses" around these items not being as secure.
If a manufacturer is turning out massively insecure devices then people tend to stop buying them if the pain of the security weakness becomes more than the pleasure of service the item provides. We have a saying here "Vote with your wallet." Which basically means if enough people are unhappy with the product, then they stop purchasing it. When sales fall off enough, it no longer becomes profitable for the company to continue making it.
The Infosec answer, in my opinion, is that it is the responsibility of the security staff to:
1) Know what is on their network
2) Search for vulnerabilities on their network
3) Find solutions for identified weaknesses and present to senior management
4) Put the responsibility for either finding secure solutions for the weaknesses or document and have senior management accept the risk.
5) Start back at #1
So my final answer is that it is the security's staff responsibility to find secure ways of having them on the network, with the ultimate culpability and responsibility residing with senior leadership.
