Obviously the companies are responsible for the stuff they make.
If companies make crappy software or groceries stock rotten vegetables the invisible hand of the market will take care of it and put them out of business.
This law, while well meaning, has obvious side effects that might make things worse than they are today.
Most importantly it creates an incentive for companies to create a culture of not looking for vulnerabilities. If they have a vulnerability they don't know about, they are fine. If they do know about it, they are potentially liable.
Then there's the issue of who decides what is a vulnerability. And if you think that's obvious just read "The Old New Things" blog for many examples of "vulnerability" reports that boil down to "If I can run program with admin privilege's, I can do bad stuff". Or look at US senators and governors who think that looking at HTML is hacking.
Finally, not of that is free. Government doesn't make money, it takes it from you. So when we create new regulation that require more government employees, you're paying for it, indirectly.