Setting aside the fact that the training device was not properly accounted for at the end of the exercise, I would make the following points.
1. The ground is visited on a daily basis by fans doing the club tour and I presume they go pitch side. I would expect security checks to be carried out before and after close of business.
2. Match day I presume a full check is carried out and completed before gates are opened, and zones are reported to control as being clear. If this is the case it should be possible to identify who takes responsibility for saying an area is clear when it obviously wasn't.
3. Following the training exercise did United not do their own security sweep?
4. Who ever is responsible (Trafford) for the issue of the safety certificate needs to be involved in any investigation, which needs to be carried out by a completely independent person.
The responsibility for this lays squarely at the clubs door. Bournemouth and their fans have been penalised and as already said United have an advantage for the Final. The Premier League should reverse their decision to replay and the three points awarded to Bournemouth.