To be clear, I am absolutely not arguing that malware authors should get impunity - we have other laws such as the CFAA that should be used to punish this activity.

I am also not saying that software developers should automatically be liable for bugs or security vulnerabilities in their products.

My concern is that such a precedent would then allow software developers to sue on brand damage grounds even in non-malicious cases such as merely documenting an exploit or publishing a proof of concept (designed to test the vulnerability on your own infrastructure), in which case even "mens rea" would not apply since technically documentation/PoC code is intended to let others know about the vulnerability (so they can protect themselves, but that does technically damage the brand, although rightfully in this case).