The following is my original answer, which I stand by as being logical and on the face of it applicable, though it does not seem to tell the whole story. See below for a revised answer.
You are right: it should be who here.
This is a simple (and fairly common) case of hyper-correction, where people who are not quite sure how to use who and whom correctly end up using whom in places where it should not be used because they think it sounds ‘fancier’ and therefore more formal (a logical enough thing to think, since whom is indeed mostly used in formal contexts). This happens even in places where whom is quite clearly impossible to anyone who distinguishes the two forms, such as “I did not know the person whom was sitting next to me”.
In this instance, however, the mistake is easier to understand, even if made by someone who distinguishes who and whom: the intervening parenthetical phrase “it is foreseeable” probably influenced the choice. It is obvious that it in that parenthetical is the subject, which probably made the author think who(m) would then have to be an object—having two subjects right next to each other is not common and usually avoided.
Revised answer that tells a fuller story (based on comments by Araucaria and myself below, some of which have been incorporated into the answer itself and therefore deleted to improve the legibility of the comment chain)
As Araucaria has shown below, there appears to be more to this than meets the eye. This particular construction is not as straightforward as an initial analysis that simply removes the “it is foreseeable” as parenthetical information might suggest, for the following reasons:
There are many instances of the oblique-case pronoun whom being used in this type of construction, especially in the field of law, but also in literature and elsewhere
The deletion properties of the pronoun in these constructions match those normally found with object pronouns, rather than subject pronouns
For examples of (1) above, I refer to the quotes unearthed by Araucaria in the comments below and in the comment section of the question itself. They show quite clearly that, whatever prescriptive (or even descriptive) grammar says, forms with whom are quite common and widespread, even in proofread, formal texts written by able language users.
If you transpose various elements in the sentence, you really end up with a fairly complex structure.
… persons whom it is foreseeable are X …
– is made up of a head noun and a following relative clause. The relative clause itself, however, is made up of a main clause and a complement clause (in layman’s terms often called a that-clause). The pronoun (which, being a relative pronoun in a relative clause, must stand at the head of the clause) is really the subject of the complement clause embedded in the main clause. In other words, if we split up the clauses to avoid a relative clause, strange things happen. Compare:
I have two friends who are fans of Lady Gaga. => I have two friends. They are fans of Lady Gaga.
– where the relative clause is the same as the resulting main clause, except for the pronoun; with:
I have two friends who(m) I think are fans of Lady Gaga. => I have two friends. I think (that) they are fans of Lady Gaga.
– where the complement clause (that) they are fans of Lady Gaga is split up to allow the pronoun to be raised to the head, enabling the containing main clause to function as a relative clause. The relativiser is extrapolated from an embedded clause, rather than being present in the main clause itself. The only thing that could be relativised in the main clause (it => which) is left alone for semantic reasons: it is not a possible anaphor for the antecedent persons
With this much moving around, it is hardly surprising, really, that extrapolation of an embedded subject to become the relativiser in the containing clause can wreak some grammatical-logical havoc. Even with this analysis in mind, I still cannot determine what grammatical role the extrapolated pronoun ought to play in the relative clause (as opposed to in the embedded complement clause, where it is clearly the subject). It seems, if we go by actual usage, that it can be interpreted as either subject or object.
One fact that proves that the interpretation as object is real and not just people being confused about when to use whom is relativiser deletion. In a relative clause, the relativiser1 must be present if it is the subject in the clause:
My friend who loves Lady Gaga.
– but is optional if it plays a non-subject role in the clause:
The Lady Gaga song (that) my friend loves most. (object)
The Lady Gaga album (that) my friend gave a 10/10 rating. (indirect object)
The Lady Gaga dress (that) my friend wrote a school essay about. (prepositional object)
In the example from this question, the relativiser can be deleted, which clearly shows that it is interpretable as a non-subject element (my guess would be it’s probably some kind of vaguely adverbial element more than a real object):
[Y]ou owe a duty to persons (who[m]) it is foreseeable are X …
If we consider “it is foreseeable” to be a parenthetical statement and remove it, this deletion is not possible:
*[Y]ou owe a duty to persons (∅) are X …
This suggests that the relativiser in your sentence (with “it is foreseeable”) plays the role of non-subject, and whom is appropriate.
On the other hand, if we look closer at the complement clause itself, a very striking and rather annoyingly contradictory phenomenon can be gleaned.
Normally, in English complement clauses, the complementiser (that) is optional. In some cases, it sounds clunky to have it, in others it sounds clunky to leave it out—but it is usually not ungrammatical to do either. This is also the case in constructions like the present ones, but only if the relativiser is a non-subject in the complement clause. Regardless of what role the (also optional) relativiser who(m)/which/that plays in the relative clause (= main clause + complement clause), the complementiser that can be left out or kept in as long as the relativiser is not the subject in the complement clause:
The Lady Gaga album (which) I think (that) my friend is listening to.
Here, both relativiser which and complementiser that can be left out or kept in with no change of any kind.
If the relativiser is the subject of the complement clause, however, the complementiser appears to be mandatorily blocked—it simply cannot appear:
The Lady Gaga album (which) I think (*that) is playing now.
This is most peculiar, and I have absolutely no idea why it is so; but it is. Having the complementiser in the sentence here is completely and utterly ungrammatical in any register or form of English I’ve ever seen.
In your sentence here, adding a complementiser makes the sentence quite ungrammatical:
Persons (who) it is foreseeable (*that) are likely to…
This suggests that the relativiser must be playing the role of subject, and who is appropriate.
This is rather messy, but it seems to be true: the relativiser here is either both subject and object or neither subject nor object, depending on your point of view. No wonder people get confused about whether to use who or whom!
1 For present purposes, I consider it unnecessary to distinguish between complementisers and operators (=relativisers), since they are mutually exclusive anyway. I thus use relativiser for both that and who(m).