If I sell you a hammer and the hammer breaks sure I'm liable. If I sell you a hammer and you hammer in somebody's head, I'm not liable. The second scenario is

If I sell you a hammer and the hammer breaks sure I'm liable. If I sell you a hammer and you hammer in somebody's head, I'm not liable. The second scenario is what we're actually talking about for developers. If I write VoIP code and you use it to commit ransomware; nobody is taking a developer to court over it. At best corporate is going to court. Even in the first scenario, you can't sue the individual worker that produced the hammer. You're limited to getting a refund or replacement of the hammer from corporate.