Every person has a duty of care to minimize the possibility of harm to others. In some professions the standard is higher and may be codified into statute and/or bylaws of their professional association e.g. medical and legal professions. What this means is that, for example, in certain jurisdictions a doctor is bound by his Hippocratic oath and has to render medical assistance to a person who is in urgent need of it, as quickly as practicable. Ignoring this exposes him to liability. So in the particular case of software, a malware author could in theory be found liable by posting his proof of concept in the public domain.

Secondly, in certain jurisdictions, there is an implied warranty of merchantability and also of fitness for a particular purpose. In the US this is under the Uniform Commercial Code.

The example you cite of a doctor being required to provide emergency medical care I don’t think is quite accurate. In fact, doctors are often not covered by “Good Samaritan” laws and can be held liable if they do stop to help someone and something goes wrong. A layperson would not have that type of legal exposure. Medical treatment issues are complex and I can’t see how they are related to open source software.

In the U.S., a doctor has no affirmative duty to provide medical assistance to injured persons if they have not established a special relationship with the individual.

https://en.m.wikipedia.org/wiki/Duty_to_rescue

Read the last part about the elderly man who died in a bank and no one offered assistance.