Who is responsible - CFII or the Private Pilot?
There is a contradiction in your question.  

You say both the student and instructor are logging PIC.  This is fine, but the authority for this to happen depends on certain things.  


The instrument student logs PIC under 61.51(e)(1)(i)


  (1) A sport, recreational, private, commercial, or airline transport pilot may log pilot in command flight time for flights-
  
  (i) When the pilot is the sole manipulator of the controls of an aircraft for which the pilot is rated, or has sport pilot privileges for that category and class of aircraft, if the aircraft class rating is appropriate;


They are acting as PIC as the sole manipulator of the controls and must be rated for the aircraft.
The instructor logs PIC under 61.51(e)(3)


  (3) A certificated flight instructor may log pilot in command flight time for all flight time while serving as the authorized instructor in an operation if the instructor is rated to act as pilot in command of that aircraft.


This only applies on instructional flights, where the instructor is providing instruction and is rated to act as PIC (e.g. if the instructor lacks a medical and could not act as PIC, they could still provide instruction if the student is the PIC, but the instructor would not be able to log PIC).


The reason I say this is a contradiction is that you claim 


  Let's say it is just a normal VFR flight, and they're getting back to their home airport after a training flight.


This makes it sound like it is not a training flight and in that case only one of the pilots could log PIC using the sole manipulator rule in the absence of instruction taking place.

It turns out the above isn't directly important, as logging != acting PIC, and the acting legal PIC is what matters from an authority and enforcement perspective.  What the above logging issue gets at is hinting at who might be the legal PIC absent the two pilots agreeing who would act as the legal PIC.  

In the case instruction is taking place even though the student is logging PIC  the instructor is also logging PIC and is the "ranking" pilot in the flight and may be viewed as the legal PIC.  In the case of a non-training flight (which would be hard to justify if you both logged PIC), then it comes down to the question -- who agreed to act as the legal PIC?  Either of the student or instructor could act as the legal PIC, but on a non-training flight only the one of you actually manipulating the controls could log PIC.  If there was no agreement prior to the flight over who is the legal PIC, the FAA will still probably decide the CFII was the legal PIC or the FAA may decide to go after both of you.  I believe there is precedent for this in enforcement action, but I don't have any cases handy to reference.  



What should you do about this?  Both the student and the instructor should fill out a NASA ASRS form and preserve evidence that you submitted it within 10 days of the event.  If the deviation was not willful and the controller decides to pursue action, this will protect you from enforcement.