Officials at the cyber agency are doubling down on shifting the security onus to software makers.