So: A makes a product with flaws, B makes an exploit, C leaks that exploit, D adds a harmful payload to the exploit and goes on to extort/profit from E, who has computers systems they failed to patch in time... and somehow B and only B is at fault?