[armchairhacker]

Normally I agree, except in this case when the maintainer becomes the aggressor and literally installs malware to the user. This has nothing to do with FOSS and contributors being obligated to write better code, this is deliberately hacking someone.

That's like saying "it's your fault for giving them your password" when someone opens a phishing link. Yeah, all the scammers did was host a website and send emails, you chose to provide them your information. It doesn't make them not liable.