I'm thinking the "obligation" or better yet, the "liability" might come down to foreseeability. Foreseeability is a legal element of liability. For example, if a business knows through experience that a certain crime is likely to occur at the facility, and management does nothing to warn or inform customers that the customers might be endangered while patronizing the facility, and alas, the customer does in fact get injured, the facility is likely to be held liable for neglecting to inform or protect the customer against this foreseeable crime. However, if the facility could not reasonably have foreseen that someone might be hurt by the facility's action, then there may be no liability, or at least it might be extremely difficult to prove the liability in court.