Indeed, and if that software can't point to some contract or license that suggests someone else is liable, then they are responsible. Funnily enough, almost al

Indeed, and if that software can't point to some contract or license that suggests someone else is liable, then they are responsible. Funnily enough, almost all open source projects not only disclaim such liability in very large print at the top of their licenses, but they don't even complicate the relationship with some kind of purchase agreement and renumeration. They literally just say "Here's a thing. Use it if you want, change it if you want, but you're responsible for making sure it meets your requirements."