Liability may also be to third parties. Actually, I'm surprised that someone facing a DDOS attack from compromised Windows systems hasn't sued Microsoft for negligence. The victim is not a party to Microsoft's EULA in that case.