If we make the software vendor responsible, who pays for open source vulnerabilities?