I am shocked to see the "let's make writing vulnerable code illegal" take be so popular on HN. If you have written any meaningful amount of code, you have written vulnerable code.
Writing vulnerable code is not illegal, negligence is.
Every case I've seen in my career where this has happened has not been "negligence" but developers not realizing there's some obscure logging middleware or something.
Devil's advocate: my bridge fell down because I didn't know the concrete didn't meet spec still seem like negligence?
Cool story I guess, but that’s not related to anything I said.