The OP has it wrong. The theaters would be liable.
Remember the shooting that occurred at a screening of Batman: the Dark Knight? Well, some families of victims are suing the theater and the case is still ongoing. Because there's a chance that the theater may be found liable of not having "enough security" for a random shooting, and because it can be argued that the theaters in this case were "warned ahead of time of a potential attack," they could potentially be found liable should anything happen.
Keep in mind that Sony is only pulling the release after the five largest theater chains refused to show it. And the reason they refused to show it is because they could potentially be liable should anything happen anywhere in any of their theaters. Given the poor reviews the movie is getting they presumably decided that it just wasn't worth any risk as they're probably not going to make much anything off showing it anyway.