The criminality is putting a program on the internet which you know is full of security holes.

It's not legal for me to set up a shop selling known faulty electronics, or even give them away for free unless I make clear I know they are faulty. I wonder if this should be extended to tech.

I'm not saying they have to take the code down entirely, but they could pop a big warning on the download page at least. They are knowingly having thousands of downloads a day of software they have known is dangerously broken for over a year.