Only in the sense there's no explicit legal responsibility.

Do you really believe developers have exactly zero moral responsibility to their users? None at all?

Really?

Would you still believe that if you found the developers of ssh deliberately included a backdoor for hackers, or neovim was uploading everyone's code to the NSA?