Why not both? Apple should be held accountable for their software ignoring the flags set by the user (if that's actually the case, and I'll get to that later), but Google should be held accountable for exploiting a weakness in someone else's systems.
If I were to exploit a bug for profit, I'd get to look forward to federal PMITA prison. When large corporate conglomerates do the same thing, they get to laugh about how they didn't cause anyone financial losses, so they should get away scot-free.
That being said, the "Do Not Track" flag was never a setting that stopped tracking cookies from being set by websites, it was an extra flag sent along with your request that said "Pretty Please with Sugar on Top, Don't Track Me, Okay Guys?", which any websites were free to (and I assume they all did anyway, especially Google) ignore. I don't ever remember a setting in Safari that disallowed cookies but wasn't "Private Browsing" mode. Private Browsing just clears everything when you close the browser, so the only other setting could be the "Do Not Track" flag.
Which anyone who was paying attention should have realized was completely bogus to begin with.