of course he is responsible ，the users buy the system from him as well as the security.Just on account of users' trust,can developer earn money from users.so,I think he is responsible if his system is not so perfect.