Does this mean that you think a company should not be held liable for defects caused in a product they ship, if the defect is caused by an open source component?

Why not?