Your question(s) only become important following an incident, and the resulting claim.
I can only speak from the UK prospective. Not all dive insurance companies cover diving beyond formal training depth limits; even those that do have an exclusion clause (usually well hidden away) that if depth was a contributing factor the diver must have been formally certified to the depth. If I took a buddy past their training certification (the depth they had been formally signed off at) and there was an incident, I would be deemed to have dived outside BSAC’s Safe Diving and would have to fund my own defence, as BSAC’s 3rd Party Liability cover is based on me following the guidance.
Yeah, it's a tricky one since local regulations prevail...
I think I'm still considering the matter from an incorrect prespective, forgetting that in RSTC divers are autonomous in buddy teams, sign a liability release outside Europe, and that a dive guide doesn't even need to be in the water (indirect supervision), and the divers don't need to follow the guide, being ultimately responsible for the dive plan and subsequent actions.
So I guess it would be up to the service provider (dive shop) and guide to justify that they put everything in place to conduct the activity safely, but that ultimately the responsibility is the diver's only.
And it's also up to the diver to check what their insurance covers, under what conditions.
Completely different in the French setting for instance, where the structure + staff is held 100% reponsible in case of an accident and has to justify its way out, proving that everything was done legally (respecting legally set depths, equipement maintenance obligations etc)