Are they legally liable in any way for including deliberate flaws in a piece of software they know is widely used and therefore creating a surface attack surfac

Are they legally liable in any way for including deliberate flaws in a piece of software they know is widely used and therefore creating a surface attack surface for _any_ attacker with the skill to so do and putting private and public infrastructure at risk ?