That's a question of political ideology. I can just say that right now that's what the general expectation is. Or at least, corporations get enough flak if they don't fix the issues that they feel compelled to take the responsibility and avoid badwill. But one could certainly imagine a law where individual users are liable for the malware running on their PC:s instead.

Personally I think it's good that developers take the responsibility, because there are too many users that will not upgrade and that causes a societal problem. For example, it becomes hard for banks to protect accounts when people log in using PCs that have tons of software with security holes.