Yeah, that's really unfortunate. I think the market would be way more dynamic innovative, and secure if such large packages would be foss. Larger companies can have their own full or part time specialists, and smaller ones can put out bounties etc