The companies using it didn't (generally) have a commercial relationship with the authors, so I'm comfortable leaving the users holding the responsibility. Fair question, though... I might even prefer to make liability only follow services, not code. So if you make a SaaS that takes PII, that's you're problem. If you publish code that can hold PII, that's still the problem of whoever uses it on PII.