It's not a "nice thing to do" and it's not really a moral issue. It's simply the point that if the security of your thriving business depends on a software component you did not author, you're obliged to do everything you can to ensure that component is safe for deployment, and for open source components one thing you can easily do is contribute to development.

There's really no way around this; it's a straightforward practical problem.