There is an investigation (for that we have the police) on how it got there and who is responsible and if something illegal (determined first by the prosecution office and then determined by a court) was going on.

And if the perpetrator cannot be found?

Who pays out for the damages ultimately?

In Germany the guilt has to be proven by the prosecution and you need to be sentenced by the court. If this can't be done, no one is hold accountable.

If something stolen is found in an office, and the company has nothing to do with it, the company is not held responsible for the theft.

What if something actually dangerous, like sticks of dynamite, is discovered in some office?

Probably the building is evacuated and the dangerous thing secured by specialists E.g. a bomb squad.

Then the same thing. The police and the prosecution find out if this was illegal, if the possession is illegal, who possesed if and who brought it and why, then who is responsible and a court decides if someone is guilty. The court will decide if the company is responsible E.g. because of negligence, they might not have implemented the law, educated their employees etc. In the case of dynamite that an employee brought, the company is not responsible, there might be terrorism charges against the employee.

Okay so my point stands?

The company is always ultimately responsible for whatever is discovered on their premises by default.