Open source projects, while they can sometimes benefit to a limited degree, don't really need loads of full-time paid staff. I struggle to believe there's any great underlying issue here.
Exploits are effectively inevitable in all internet-exposed software. For PHP, running 70% of the internet, to get caught out this rarely is a really good sign that it's working fantastically well.