What liability? If they are on a vpn there is no indication where the user originates from. States can sue all they want, but they have no legal standing as they have to prove users from their states are accessing restricted sites. It is utterly ridiculous to uphold a website to a state laws they have no presence in.
All website have to do is geoblock and reject payments from those states. If users bypass those restrictions, thats on the state to figure it out from.within their state.
Or do you think retailers across state borders should stop a customers from buying products that are 'illegal' in their home state?