They're selling network-accessible equipment so it's their duty to make it secure within some well-defined envelope. How's that any different from any other part of engineering and product development?
> "Project ships on Monday, no matter what" because who carries the risks for any flaws
Soon that will be the OEMs, per the EU Cyber Resilience Act [1]:
> Directive (EU) 2024/2853 [on liability for defective products] of the European Parliament and of the Council (16) is complementary to this Regulation. That Directive sets out liability rules for defective products so that injured persons can claim compensation when a damage has been caused by defective products. It establishes the principle that the manufacturer of a product is liable for damages caused by a lack of safety in their product irrespective of fault (strict liability). Where such a lack of safety consists in a lack of security updates after the placing on the market of the product, and this causes damage, the liability of the manufacturer could be triggered. Obligations for manufacturers that concern the provision of such security updates should be laid down in this Regulation.
With floor planning, the loss itself could be spread across multiple companies, under multiple insurance policies.
With that said, this particular hack could easily be a systems / networking "configuration error" and not any particular piece of softwares fault ( as in a bug, or hardcoded backdoor password. )