The facility said it was a “mistake” by a visitor. Are they still liable?

Yes. Facilities must have protocols to ensure that residents do not follow visitors out of the building (a behavior known as “tailgating”). It is the facility’s responsibility, not the visitor’s, to secure the exits.