The obvious counter-example is OpenSSL: used everywhere, yet survived based on volunteer work for years. I would be surprised if there weren't plenty more in the myriad of dependencies used by those well-known projects.