We already do this. My prior uni got hacked, everyone's IDs/drivers licenses/passports, mails, data got leaked. The vendor was a 4-person third party cloud provider who had all of the necessary security certifications for the uni to avoid gross negligence. No-one paid anything as the 4-man firm went bankrupt and the uni got a new provider who is fully licensed to avoid gross negligence.
With software, you can stack these shells of proxies almost for free.
Which licensed engineer stamped the software? The answer is probably “none”, because licensed engineers are liable even if their company is bankrupt. The person holds the license, not the company so it sounds like we’re talking past one another.
I worked in HW before for home electronics that had to be certified. There was no responsibility for the engineers, the cert house had to take on this responsibility, and they had a shell certification company hired who would conduct the tests and take on the responsibility. At one point there was a litigation due to an RF leakage from a LATAM-bound device causing signaling issues to public infra, but it went nowhere because of the layering of responsibility made by the cert houses. No engineer was responsible.
Most people don’t realize that many industries work within the framework of licensure, but also have industrial exemptions. There has also been a movement to peel back some of those exemptions because of the problems you point to.