Where it gets more dicey is where there may have been a protocol or procedure not followed, or recommended and dismissed, that then better allowed the attack.
The theater is going to face lawsuits. Whereas they have basic security if one comes through the front, as in 'must have a ticket, must use ticket at checkpoint, must walk in well lit areas before gaining admission to darkened auditorium", the issue will be the level of security, if any, provided to minimize the ease to which such measures are circumvented. Like coming in through an emergency exit. Or an exit designated only for exit. Was the door wired to provide some alert that it was open, and in this case, propped open ? If so, then who was not monitoring such ? Or ignored such ? How about cameras outside the back doors, on a simple closed circuit ? Or was all this possible or available, but then nixed by a company VP because it was seen as a "low crime" area ?
I am sure that the second-guessing is already in high gear.