There are a couple of different theoretical justifications for holding someone liable for some bad event that is somehow connected to them, such as when a bad event happens on their property, or a bad event happens using a product they built or sold.

The most well known one, and the only one that most people know of, is that of negligence. If you do something negligence and that leads to harm, you should be held liable for the harm and have to pay to correct it or compensate the victims. If you were not negligent, then you should not have to pay.

In a liability system based on that justification, it would make little sense to hold a theater liable for a mass shooting unless they actually did something negligent that made them more likely than other places crowds gather to be chosen by the shooter, or if they did something negligent that made the shooting worse than it would have otherwise been (e.g., jammed cell phones which delayed getting help, or did not have enough emergency exits so people were exposed to the shooter longer than they should have been).

The negligence approach can work reasonably well. It does have a couple of problems, though. First is that it may be hard to decide who, if anyone, was actually negligent in a given case.

Another approach is to have a liability system based on the idea that parties should purchase insurance to compensate them from the damages from bad events. For a given type of bad event, the law under this approach would put liability on the entities that are in the best position to estimate the risk and determine the appropriate level of insurance coverage they need.

For consumer products, that would often be the manufacturer. So for instance you might make lawn mower makers liable for injuries from their lawn mowers, even if it is the consumer's stupidity that causes a particular injury (such as not stopping the mower before reaching under to clear a blockage). The mower company would then keep track of how often these injuries occur (something they would be doing anyway so that they can design safety feature to make it harder for people to do stupid things like that), and could buy the necessary insurance, passing the insurance costs on to its customers.

If it was left up to consumers to insure against sticking their hands under lawn mowers, you'd either have almost no one buying that insurance (who plans to stick their hand under a running lawn mower?), or it would have to be covered under their general medical insurance, and so would be slightly driving the cost up for everybody else. When it is the lawn mover company that has to buy the insurance, the people who hurt themselves with lawn mowers are only driving up the cost for other lawn mower users. The net effect is that you are somewhat narrowing the pool to the people who are actually more at risk.

Note that in this "liability based on who can best insure" approach, liability does not imply fault.

For mass shootings, the question then is whether it makes more sense for each individual to purchase insurance to cover injuries they receive in mass shootings, or for venues to purchase insurance that pays their patrons for injuries when those patrons are shot in a mass shooting at that venue. If the latter, then you make venues liable for shootings that occur there, regardless of whether or not they were negligent.

For any given type of venue or any given type of product, where liability should be placed in this kind of system depends on the details of the relevant industry and market. You probably want liability placed at some entity that will have the data and/or expert knowledge to figure out reasonably accurately how much insurance to carry.

Note that negligence based liability systems and best insurer based liability systems are not mutually exclusive. There is no reason you cannot do both. You can have a negligence based system applicable to everything, and also have a best insurer system applicable to things where this is some party who has the data and expertise to deal with the insurance.