If a structural engineer builds a bridge that collapses and kills someone, they are liable in one way or another. What if the same was applied to software engineering. That would sure change how seriously you take PII.
New attack vectors come out every day. The one they used may have not even been related to THE application that someone built for this. If you built something 4 years ago for the gov't to use and they didn't keep the server patched how is that your fault as a software engineer?