They are accountable for their library, you are accountable for putting it in your production environment.

If they fail you can stop using their library. If you fail your company can stop using you.