> “developers should be responsible for their own security so we will make them liable if a random node dependency in the application they are building gets pwned”

Developers may not be liable today, but protecting company data and resources from supply chain attacks is their responsibility. At most companies, only the developer is in a position to understand how these supply chains work. Even at larger companies with security teams, the scanners and mirrors are trivial to bypass.