If open source devs make a living off it by charging users for money (or PII), the devs should be liable for the code they are selling. It does not matter if it is open source. Whoever makes a commercial offering based on that software must be liable.