The license also makes it clear that the authors aren't liable for any damages.
The license disclaims liability but that doesn't mean the author cannot ever be held liable. Ultimately, who is liable is up to a court to decide.
You find a vulnerability? patch it, push change to repo maintainer.
https://xkcd.com/2347
The license also makes it clear that the authors aren't liable for any damages.