Lovable provides tooling, the responsibility and liability is of the client that uses it to generate a system. It doesn't look like a vulnerability of Lovable itself

although I don't use it enough to know the specific details of how it is infrastructured. But since the promise is that it writes any code that you want, it's logical that the arbitrary code is not a property of the code generating tool but of the user that generated the code!