"This feels a bit like blaming unsafe working conditions and 12-hour work days at the beginning of the industrial revolution on workers, because they signed the contracts (this was the prevailing narrative from factory owners at the time too)."
That would make more sense if various companies didn't sink $1+ billion into more robust systems and software over the decades that most users & developers intentionally avoided in favor of what was faster, cheaper, supported buzzword/feature X, and/or was known unreliable/insecure. They make the same tradeoffs today. Look at use & tradeoffs of Facebook Messenger vs WhatApp vs Signal vs Threema [1]. Even when cheap/free and easy, vast majority will not make slightest effort for increased security and privacy.
[1] Not endorsing Threema so much as to say it was quite marketable & good example of what should get more adoption if users aren't to blame.
Itanium got posted here recently, too. It had enhanced reliability, stack protection, read/write/execute per page, and memory key isolation if one wanted it. Most server software that was mission critical continued to run on Xeon x86 instead of leveraging improvements in Itanium even when portable source was available for mere re-compile to Itanium. Why? Xeon was cheaper and took no extra effort.
Rinse, repeat for all kinds of software and tooling. There's often supply but little demand that pays. Which sucks extra here given high reliability or security costs more not less for producers. There has to be sustained demand that will pay at least 30-50% premium to develop each component or app. Since there's not, the companies are entirely justified in producing unreliable, insecure or surveillance-oriented garbage for people that exclusively use or buy such things. And the buyers are to blame wherever there were clear alternatives that were inexpensive given their choices collectively decide the issue.
"Perhaps it's time for regulation to solve this dilemma?"
I supported that on Schneier's blog with specific points showing where market consistently fails (even for itself) and how regulation would help:
https://www.schneier.com/blog/archives/2011/09/an_interestin...
Despite low demand, I also actually write a counterpoint justifying continued focus on niche that cares about quality/security with recommendations for "low-cost but high-value" practices to deliver that profitably as a differentiator. What's in this post is an example of how my software liability argument in other one might play out. Regulations would enforce stuff known to knock out problems consistently to form a better baseline without driving up cost or having vague stuff prone to frivilous lawsuits.
https://www.schneier.com/blog/archives/2013/03/is_software_s...