It's on both. It's the passenger's responsibility to board the right plane, it's the staff's job to ensure no unauthorized person boards a plane. In fact, this can pretty much only happen if both sides mess up.

The fact they did the numbers, they didn't match up, and yet they still wanted to depart is pretty bad. That illustrates this probably wasn't the first time the numbers don't match due to certain ops factors and they just roll with it. Not exactly reassuring from a security standpoint.