No idea about the vibe-coding platforms, but systems like Claude Code have explicit allowlists for commands. Don't allow it, and it'll ask permission each time.
I mean, can't it be both? Individuals have personal agency and are responsible for their own actions. Individuals also respond to incentives which, in aggregate, alter the observed distribution of those individual decisions. The problem can be addressed at both levels.