Yes, with the CAA having strapped down the training options so tight nobody can move, they cannot really say with a straight face that they are not responsible for a hypothetical FTO being run by a bunch of shysters.
OTOH I can't see what they can do that would be useful. You cannot regulate business practices. The institution of a Ltd Co is now centuries old and despite it being a hugely popular vehicle for incompetent / dodgy business practices of every kind (as I well know having been in business since 1978) nobody has done anything about it. Only in the most blatent cases can Directors be disqualified, and then you just get your wife / brother / cousin / son / etc to run the next incarnation.
What I can see happening, one day, is a student suing the CAA for the money he lost. This is because the CAA is sailing very close to the wind with its FTO approval and charging regime, while not regulating FTO financial viability. The fact that the latter is, as I say above, impractical, is not relevant.
A related example of liability is the UK AOPA mentoring scheme, whereby (it appears) AOPA had to get insurance to protect itself because it is so obviously acting as an "introduction agency" and a "vetting agency" for the mentors - by requiring them to be AOPA members.