No matter which component caused the bug, the device vendor that made the final product should always be responsible, unless it has a contract outsourcing the responsibility for a specific component to another entity. If the vendor simply used open source libraries, then it needs to review and take responsibility for the code, or hire a contractor to do so. This might also incentivize them to provide timely security updates, in order to minimize damages.

If they were liable there is no profit margin. These products will never exist.

No, they still would. People do amazing things under constraints.

You need to bundle mandatory, sizable insurance as a requirement for getting the license to sell/not selling illegally (i.e., treat the device as illegal as an insurance provider who is not licensed to sell insurance, not as an unlicensed medical doctor). The insurance would make the vendor fix his shit. And he can't just chicken out. Make some way for sufficiently large companies to self-insure, or they will be mad. If they don't get mad, they probably like the reduction in competition.

At the end of the day, the end consumer will pay.

Yes. But he better try to line the incentive's of those he does business with up with those you have.

> If the vendor simply used open source libraries, then it needs to review and take responsibility for the code,

I can imagine a lot of licensing hassle here. Worked for Technicolor in Edegem, not on routers / STBs but know the challenges. There are tons of libraries used by virtually every device in the field that no company will touch b/c of licensing hell.

It would also incentivize vendors to fund critical FLOSS with direct development support on safety-critical functionality.