I don't really see it as a primarily driven by liability. I see various federal agencies as strongly discouraging increased private investment in security infra

I don't really see it as a primarily driven by liability. I see various federal agencies as strongly discouraging increased private investment in security infrastructure via very public demands vs Apple to decrypt their devices, and very secret national security letters also requiring decryption. Any company has to see that as a potential risk - after putting in R&D funding to secure their products, they could be then required to break their own encryption or face legal jeopardy. Several small businesses have been driven out of business by such behavior, and large business have mostly capitulated.