Yeah, if Apple says "This is our official package manager, and you can use it to install OpenSSL/nginx/whatever", like or not, they are on the hook if it breaks, and they have to fix it. Like, companies are going to be like "we trusted you and now our website is broken, and we're going to sue you".

Homebrew gets away with this a little bit by basically being unofficial, implicitly saying "we're not guaranteeing anything here, this is purely for convenience". It would be much harder to make this argument if you were an official Apple project.