Site owner is responsible for keeping WordPress updated, whether it be keeping WordPress updated themselves or paying someone to do it for them.