Can a firm be held liable even if it didn’t approve the investment?

Yes. If the firm failed to supervise the broker or ignored red flags, it may be responsible.