> Let's say it was coded extremely well, but nevertheless a more advanced exploiter wreaked similar havoc.

A doctor kills a patient because malpractice. Could that patient have died anyway if the patient had a more critical condition?

That is a non sequitur argument.

> Would they still be liable in your perfect world?

Yes. The doctor would be liable because did not meet the minimum quality criteria. In the same way that the developer is liable for not taking into account any risks and providing a deeply flawed product.

It is impossible in practice to protect software from all possible attacks as there are attackers with very deep pockets. That does not mean that all security should be scrapped.