nobody should fault the person who have coded the bug, unless someone can prove it was done on purpose. What I am suggesting is that the project as a whole has the responsibility to not just sit on data losing bugs for 17 years without warning users.

the fact that they choose not to, makes me perfectly OK with them being held criminally liable.