So: A makes a product with flaws, B makes an exploit, C leaks that exploit, D adds a harmful payload to the exploit and goes on to extort/profit from E, who has computers systems they failed to patch in time... and somehow B and only B is at fault?

FTFY: and somehow D and only D is at fault? You'll see that they'll get the blame and the rest goes free.

So does being able to enforce it. No one is going to sue the US DoD and come out winning.