why are they not liable for damages?

The more relevant question is: how would you (or another random end user) prove that the malware was served through their, and only their, site?