> What reasonable case is there for making them not liable for the damages caused?

After what period of time? Microsoft updated Windows XP after the official end-of-life of the OS for consumers with the patch to the Samba protocol to prevent WannaCry, but if they hadn't bothered, would they still be liable? Should they?

Are they obligated to update pirated versions of their OS?

Is the manufacturer liable if they release a software patch but the product owner doesn't apply the upgrade? What share of the liability should each party take?

Software is largely immune to liability litigation in the USA because the current legal status of it is not legally "a product". Converting it to "a product" for the purposes of liability is a major sea change for our understanding of what business models can be applied to software, licensing, ownership, etc.

Also, does the average product programmer carry some sort of programming insurance? Are we going to force every web developer and every open source programmer to carry insurance, to be licensed to program, and to live up to specific ethical standards?

I'm not saying these are undesirable changes, just that they are changes and there are a ton of issues programmers don't foresee that should be discussed before making

Well, we just did a recall where the airbag was replaced in a more-than-ten-years-old car. I'm pretty sure they did that because, yes, they were still liable.

You're right that they should be liable, but pragmatically it's maybe too much of a risk for smaller companies to face some potentially frivolous lawsuit for millions of damages supposedly caused by a ddos originating from some of their devices or something.

Surely the right idea in principle, though. I'm just not sure how realistic is it to implement in a smart manner.

That's what the insurance industry is for. Just make the companies liable, and they will seek insurance. Insurance companies will force them to take reasonable measures in order to carry a policy. Nothing new under the sun.