The question is, would we expect authors of libraries to indemnify other developers against liability if the fault is in the library itself?
If it's life critical software, then yes.
You don't get to blame civil engineers for structure failure if the steel provided had material faults (that couldn't be detected by said engineers exercising due diligence).
Yes. The fact that more than likely it was their PHB who made the decision, not them.
That, divorced from further arguments, is not an extraordinarily strong argument against liability for defects. After all: the engineer who builds upon such a stack has presumably, more or less consciously, made the decision that defects are acceptable - otherwise they would have chosen something less complex. Is there any particular reason someone should not be held accountable for that decision?