If the consultancy delivers vulnerable software to the customer, the customer would most likely sue the consultancy for any damages they incurred. Especially if there is a maintenance contract, where the consultancy handles any security upgrades etc that are necessary.
This is what Lovable's terms say:
https://lovable.dev/terms