It promises to shift liability onto private firms and create incentives to defend against critical vulnerabilities.