...and what open source software license in the world makes the author liable for damages?

None. That is how RedHat makes money.

Probably more of lack of explicit liability in the license.

Pretty sure the all caps text on the bottom of most open source licenses out there makes it clear

every OSS license I've ever seen is "use at your own risk" essentially. That's how this whole system works.

You find a vulnerability? patch it, push change to repo maintainer.

https://xkcd.com/2347