I seem to recall that the heartbeat bug was in a library where the author received (very little) monetary compensation for their work. Who’s responsible for co

I seem to recall that the heartbeat bug was in a library where the author received (very little) monetary compensation for their work. Who’s responsible for compliance in that case, the dev or the thousands of companies who used the library in a critical role? I know this is supposed to fix such a situation but they aren’t going to be taking hundreds of thousands of website operators to court who used the freely provided library without auditing the code.