If a flaw in an operating system's security allows a malicious programmer to gain unauthorized access to sensitive data, to what extent should the developer of the operating system be held responsible?

Social issues to operating system's security

If a flaw in operating system's security allows a malicious programmer to gain access to sensitive data, developer is responsible for the flaw in security since user trusts in developer when granting access to the sensitive data to the software. Developer should take necessary precautions when developing the software to avoid security flaws.

Legally speaking, the extent to which a developer can be held responsible for software flaw depends on the terms and conditions user agrees with the developer.

Ethically speaking if it is open source software and developer had tried his best to avoid software flaws, it is not right to blame the developer but if the user paid a hefty amount for the software to obtain rights from an organization, then the entire blame goes on organization as it works in an systematic manner and it should be able to avoid any such software flaws.