Whoever sold the vulnerable software should be liable for damages.