So say if the CIA created a bunch of malware, and then let it out in the wild, they'd be liable for all damages right?

Oh wait, WE'D be liable, because no one in government is responsible for their own actions... just like any bunch of five year olds.