While criminal botherders are in a sense "more" responsible for the damage, Microsoft also has some liability in their negligence when then wrote vulnerable sof

While criminal botherders are in a sense "more" responsible for the damage, Microsoft also has some liability in their negligence when then wrote vulnerable software. But it's relatively easy to hold MS accountable for their part than to extract damages from botherders. So MS either covers their butts by locking down the software or pays out the nose for damages.