> Is every product user liable when a vendor ships some stolen code?

No, but the difference is the users of a product are typically not making and distributing copies. That’s not the case if you use someone else’s code in your project.