Presumably similar to the accountability that applies to PEs. A smaller group of engineers than all engineers sign off on parts of the system, they're assuming a legal responsibility and the penalties for malpractice can go all the way to imprisonment.

Non-licensed engineer are not liable in the same sense, their employers and PEs are. Same thing could apply in software, but people whine too much and it probably won't happen. Every time the topic comes up, people chime in with "But software is different. It's hard." and expect that lame ass excuse to be sufficiently persuasive. Software is also critical, not all, but a lot. Critical systems warrant additional scrutiny and liability.

What aspect of this "acropalypse" bug amounts to malpractice?

An undocumented change to a core system behavior that fundamentally altered how (likely) most applications behaved in an unanticipated (for the users of the system and programmers targeting the system) way. That's malpractice.

Yeah, I don't buy that. Too much Monday-morning quarterbacking.

I'm not against some well-thought-through standards for certain safety-critical applications, but it's got to be a lot better than "maybe code would be better if we threatened to throw engineers in jail for contributing to complex and subtle interdependent bugs that caused a privacy bug that didn't have a significant real-world impact".