How many systems where actually compromised in an unrecoverable manner costing thousands or millions, maybe even billions of damage due to any of those Vulnerabilities?
All of them combined to not even come close to the damage that occured over the weekend
Shellshock, heartbleed were a inconvenience for some sysadmins and click bait for the tech press
If I give away "free lemonade", but people get sick because I've made it in dirty conditions, I will not get away just because it's free.
What's your alternative? Are you suggesting we _do_ fine all the OpenSSL contributors? Or that we do not hold anyone except end users responsible for software/hardware security?
I'm not sure metaphors or comparisons between software and lemonade are entirely helpful - although they do push the discussion along, which is at least interesting... (So if I didn't _make_ the lemonade, but published my "4 lemons pulped, 1/2 a cup of sugar, and 2 teaspoons of rat poison" lemonade recipe on github - then you made it and got sick... Who's in the firing line then? What if the README says "this recipe is satire"?)
Do we fine the person who committed the faulty logic, the reviewers, the entire community who "peer reviewed" it?