Take a look at Palantir's trust center: https://palantir.safebase.us
Schellman did their audit and compliance - do they have blood on their hands?
How about AWS, GCP, Azure cloud resources used by Palantir - are they stained, too?
Is the manufacturer of the bomb responsible for when Israel drops it on a family home in Gaza? Yes. Is it the same responsibility as the general who gave the order? No. Is it the same as the pilot who followed the order? No.
Does that make it useless to hold people accountable? Of course not.