If you can't patch it, you must issue a patch that announces the vuln and disables the minimal set of functionality that enables it. Even if that's the whole program.
IMHO, a better solution is to create legislation that forces software to be sold and distributed under a set of public, common terms.
If the rest of the market worked the way software does, everytime you went into a restaurant, bought a book, or used a photocopier you first would sign a long contract freeing that business of any liability whatsoever.
If I go to a restaurant and the Food poisoning kills my family, I can sue them. If I buy a book at the store, the store cannot mandate that I not read the book on Sunday. If you buy the book on Amazon Kindle, they are free to stipulate pretty much anything.
If software and digital products were sold with universal, reasonable terms, companies and individuals that were damaged by grossly negligent behavior could sue and have those damages repaid to them. This incentivizes companies to behave better. It is also more general purpose. We don't have to add one new regulation for every way a company can possibly be grossly negligent.
FTFY
We place too much trust and rely too much on computer systems these days to have the luxury to write software like we used to.
And I'm arguing that not doing so might be a good thing. I shudder to think how we'd be off if other infrastructure disciplines took the same approach we take to develop software.
If you build something that people use in important infrastructure, prepare to be on the hook if it fails.
If this person presented it as a real solution, however, then yes I believe he should be held liable, as much as a lawyer would be for recklessly giving out legal advice.
In either case, The developer who built upon the solution without validating it or verifying its correctness should bear most of the blame, regardless of how the answer was given.