Some parts of this reasoning are legally unsound, yes the developing organisation is responsible for its own code but its a far stretch of legislation to claim that the primary developers are in any way shape or form responsible for the activities of unknown others , this flies against common sense and natural justice, taken to extremes it would make a baton manufacturer responsible for the activities of a policeman abusing a suspect with one of their products, its a poor judgement and should be appealed.
This ruling confuses primary liability with third party liability and in most european courts such actions fail due to the weight of legal proof required to show appropriate or even inappropriate levels of culpability for those third parties.
The only possible reason for a court to find against the developer is if it can be shown that they either encouraged or allowed (with knowledge of such activity) a third party to create additional functionality that broke some law or other in such a case its a simple judgement. Whats not clear in the article is the question of who's name was on the src when it was shown to the court as the article states it was the primary developer and this might have mislead the judges to assign liability for any code that breached someones rights, if it was pointed out to the judges that the third party had not modified the original copyright notice and thus was in a separate breach of the the terms of possibly a GPL licence also, this might have had some sway with the courts.
