If that's true (I have no idea if it is or not) - I'd class it as a bug in the legalisation. Consider a router I've purchased. It has a bug that allows 1000's of them to be corralled into launching a DDOS against someone. The reality is I don't particular care that happened - it didn't effect me. But the person it did effect didn't buy it.