They are indirectly if not legally liable. If they tried something as damaging as Nano Defender here, it would be massive bad PR and they would be forced to backpedal or lose industry trust.
I agree that they’re liable for some things in the court of public opinion (which happens to have a very short attention span and limited agency), but I don’t see how they’re legally liable unless you’re implying that the EULA would be found to be unenforceable in court.