that is not correct in the slightest. It would only be your blame if you built and managed the lab. The lab is not US owned or managed, it's up to the lab who claims they can safely work on dangerous viruses to ensure that they keep it contained. They still own and manage and are responsible for the lab, the US just paid them for research. It's no different than the US contracting space onboard SpaceX rockets, the US isn't then suddenly responsible if the rocket misdirects and hits someone's house.
The client is absolutely responsible. If they fund the lab, they are absolutely responsible for how the lab is conducting it's research.
I can't believe I have to type this out.