This is about liability for the organization that releases a product to be liable for it - all parts of it - regardless of whether some of those parts were developed by 3rd parties (e.g. Apache). But again, the headline and most of the article are not clear about this.