The current liability framework isn't designed to handle such a question.
A self-driving car surfaces the problem in a visceral manner, but this applies to many many sectors and to any software that runs critical services/tools/infrastructure - Hospitals, Medical devices, thermostats, etc.
https://www.nytimes.com/2016/01/14/fashion/nest-thermostat-g...
https://medium.com/predict/a-simple-computer-bug-that-killed...
etc
Also, this covers physical harm, but what about economic harm? If an OS security bug was exploited by a hacker and caused you to loose all your life savings and end up homeless, can you put a linux/windows/ s/w dev in jail?