I'm not sure what criminal liability would look like, though. Who do we put in jail? The dev? QA? People who CR'd the bug? The TPM who proposed the feature? The manager who allocated time? The skip who initiated the whole project? Should they share blame and multithread a 7 month sentence together and do 1 month together?
I agree w/ you though. My company needs to alert me if any LOC I'm working on could land me in prison and I'll gladly switch projects. I definitely don't want that burden.