I'm not sure business would largely tolerate the rigor (and expense) that would come from such liability assignment in practice. Too many businesses will take

I'm not sure business would largely tolerate the rigor (and expense) that would come from such liability assignment in practice. Too many businesses will take short cuts, or decide on shortest path, and too many mid/jr devs with senior titles who don't necessarily know the difference. Nothing more fun that having a security audit of a codebase and seeing how many relatively dumb security issues are present... from SQL injection, to authentication bypass in a "modern" application.