In principle if you can prove the elements of a tort for one or more shareholders, such as by showing they used their voting control to direct negligent resourcing, then they'd be liable. There is no principal of law categorically protecting them, like a magic talisman. In practice, however, it's difficult to make that case; in particular, it's difficult to prove causation as shareholders are rarely so directly involved in the administration of a company. However, for smaller companies where the shareholder pool is smaller and they're more engaged, or perhaps even for large companies where one of the shareholders has a controlling stake and is very hands-on, then I wouldn't be surprised if there are indeed examples.

The limited liability of shareholders concerns their vicarious liability. Principals are strictly liable for non-intentional torts of their agents, regardless of whether the principal personally did anything wrong. (If they did something wrong, that's another matter.) But in the case of a corporation or similar limited liability entity, this vicarious liability is cut off at a certain point in the ownership chain.[1]

The point of this little subthread is simply that liability extending vicariously to a principal doesn't magically protect the agent. Employees are less often sued simply because it's a waste of time and energy when you can sue the employer; and while an employer could sue an employee to recover, employees rarely have the assets, and in any event it's not very good for employee morale.

So as a software programmer, when you make a commit into repository for Big Corporation, don't think you're magically protected from negligence liability simply because you're an employee. It doesn't work that way. Nobody else is magically protected, either. But by the nature of things, it's the people and entities with the most direct involvement that bare the most risk of a successful claim, along with their principals.

[1] There are proposals to tweak the rules for how and when this vicarious liability is cut-off wrt shareholders. See, e.g., https://repository.law.umich.edu/cgi/viewcontent.cgi?article... But such proposals concern the cut-off for strict, vicarious liability. Generally speaking, there are no hard boundaries when it comes to non-vicarious/direct liability for negligence, notwithstanding the often complex rules implicated when it comes time to determine whether someone was in fact negligent. By contrast, there are legal regimes where liability for negligence only extends to relationships enumerated in statute. Civil Law is in principle like this, though national codes typically contain catch-all provisions that effectively give rise to something much like Common Law Tort.