<p><pre><code>  why are they not liable for damages?
</code></pre>
The more relevant question is: how would you (or another random end user) <i>prove</i> that the malware was served through their, and only their, site?