Who is responsible if a vulnerability is found?

That depends on the situation. The project administrators can create an update, but the user or organization must also apply that update.

Open source does not change the fact that anyone who uses software remains responsible for careful management.