It's pretty clear that the liability shield doesn't cover malicious acts. The malicious act is committed by the person introducing the backdoor. There shouldn't

It's pretty clear that the liability shield doesn't cover malicious acts. The malicious act is committed by the person introducing the backdoor. There shouldn't be any liability on the company since they had no knowledge. If a user wants to be sure of the security, they can inspect the code for flaws (or rely on reviews of others who had inspections).