Are all USB controllers kept at host side?
In practice, the absolute bare minimum is a stable 5V/500ma rail with the data lines shorted together. That will cause most devices to charge at "normal" speed.

That doesn't work for everything, and there is a proliferation of hacks for progressively more complicated schemes.


  Is it the sole responsibility of the host to ensure reliable power to whichever device it is powering ?


Yes. You can't guarantee anything in particular at the client side, and you certainly shouldn't rely on it having any particular protection. There are all sorts of "USB" gimmick devices like fans and lights that just use it as a power rail.

You also need some kind of overcurrent protection in case a cable is damaged, resulting in a short circuit between the rails.