nobody should fault the person who have coded the bug, unless someone can prove it was done on purpose. What I am suggesting is that the project as a whole has the responsibility to not just sit on data losing bugs for 17 years without warning users.
the fact that they choose not to, makes me perfectly OK with them being held criminally liable.
Hell, what if the offending commit was 2 decades ago by someone who's cut off all contact regarding code since?