The idea of a for-profit institutions convincing volunteers to do the work is the same model Google uses for projects like Go, NPM uses for NPM, Docker uses for Dockerhub, StackOverflow uses for StackOverflow etc.

So far as I am aware (I am not an attorney) none of those institutions indemnifies voluntary contributors.