for (1), there are other fields where a specific (often licensed, but not necessary here) person "signs off" on the work, and accepts personal responsibility.

The responsibility is not absolute ("If anything bad happens, you get punished"), but instead relative to documented (in law and regulation) standards along with established industry standards. Issues that are resolved at trial.

I don't see why the same rules that regulate an engineer approving the plans for a bridge can't work for a security engineer approving the design of a sandbox.