When a business doesn’t provide the kind of security that it should have provided in order to prevent a crime, that business is going to be responsible for all of the harm that the criminal did. No matter how much harm the criminal did, if the criminal committed that crime because the business owner failed to prevent it when it could’ve, and really should’ve. That business is going to be responsible for all of it.