J&J's executives aren't off the hook for personal liability because of limited liability for owners (J&J is 70% owned by institutional investors, so the owners are more mutual funds than the CXOs), if there was a claim against them then owning some stock wouldn't protect them. They're off the hook because the corporation has vicarious liability for its employees' actions. To punish executives for their actions on behalf of a corporation, I believe you'd want to change agency law rather than corporate law.
Principal liability doesn't, per se, protect the agent. But certain torts can be difficult to pin on an agent personally when the negligence is a byproduct of aggregate decision making of the corporation.
A corporate truck driver who negligently runs someone over--both the driver and their employer are liable. A truck driver who, reasonably relying on his employer's mechanics to maintain the truck, runs someone over when a tire blows because of poor maintenance--not personally liable as he didn't do anything wrong, but their employer would be, as well as possibly one or more of the mechanics, and even possibly one or more executives if they knowingly, negligently cut resources to the mechanics department.
Now if the shareholders need next quarter’s numbers go up to juice the stock price and make it clear to the executive team that if they don’t reduce expenses they will find someone who will. Where should the liability lie if the only way to meet those expectations is to cut resources to the mechanics department?
In principle if you can prove the elements of a tort for one or more shareholders, such as by showing they used their voting control to direct negligent resourcing, then they'd be liable. There is no principal of law categorically protecting them, like a magic talisman. In practice, however, it's difficult to make that case; in particular, it's difficult to prove causation as shareholders are rarely so directly involved in the administration of a company. However, for smaller companies where the shareholder pool is smaller and they're more engaged, or perhaps even for large companies where one of the shareholders has a controlling stake and is very hands-on, then I wouldn't be surprised if there are indeed examples.
The limited liability of shareholders concerns their vicarious liability. Principals are strictly liable for non-intentional torts of their agents, regardless of whether the principal personally did anything wrong. (If they did something wrong, that's another matter.) But in the case of a corporation or similar limited liability entity, this vicarious liability is cut off at a certain point in the ownership chain.[1]
The point of this little subthread is simply that liability extending vicariously to a principal doesn't magically protect the agent. Employees are less often sued simply because it's a waste of time and energy when you can sue the employer; and while an employer could sue an employee to recover, employees rarely have the assets, and in any event it's not very good for employee morale.
So as a software programmer, when you make a commit into repository for Big Corporation, don't think you're magically protected from negligence liability simply because you're an employee. It doesn't work that way. Nobody else is magically protected, either. But by the nature of things, it's the people and entities with the most direct involvement that bare the most risk of a successful claim, along with their principals.
[1] There are proposals to tweak the rules for how and when this vicarious liability is cut-off wrt shareholders. See, e.g., https://repository.law.umich.edu/cgi/viewcontent.cgi?article... But such proposals concern the cut-off for strict, vicarious liability. Generally speaking, there are no hard boundaries when it comes to non-vicarious/direct liability for negligence, notwithstanding the often complex rules implicated when it comes time to determine whether someone was in fact negligent. By contrast, there are legal regimes where liability for negligence only extends to relationships enumerated in statute. Civil Law is in principle like this, though national codes typically contain catch-all provisions that effectively give rise to something much like Common Law Tort.
