It depends how you define "doing" FOSS. Yes, certainly there are many people who casually fool around with FOSS with no expectation of payment. And even a fair number of people who have some sort of spare time FOSS hobby.
But most of the big FOSS projects (especially server infrastructure/platforms) depend heavily on developers and others getting paid to work on them full-time.
Also keep in mind that many critical FOSS projects aren't big. Many are one-man shows. HN has a habit of frequently "finding out for the first time"—to much amazement and distress each time—that some project everybody's using is just kept alive by one person in their spare time.
Absolutely. That's why the Core Infrastructure Initiative was created a few years ago for example. While I haven't made an exhaustive study, my sense is that the situation is at least better today than it was a few years ago, especially with respect to security issues. Though always more work to do to support developers working on critical infrastructure of course.
Yes, there is a long tail on projects like the Linux kernel. But a lot of that long tail doesn't individually do a lot of work. And, according to the seemingly latest Kernel development report that I have: "Well over 85 percent of all kernel development is demonstrably done by developers who are being paid for their work."
But yeah, it's hard to get paid. I was lucky enough to have a company pay me to contribute to an OSS project, but they didn't hire me for that purpose, I had to hustle for it and was blessed with a great manager who supported the idea.
I really doubt there are many long-time FOSS contributors who want (as their top-level goal) to be paid to do FOSS, but still haven’t managed it after months/years of trying.
Most people who do FOSS don’t do it with the goal of being paid for it. Just like most people who play a sport don’t do it with the goal of being paid for it. For most people, it’s either a hobby, or a byproduct of the efforts they go to in their day job (i.e. fixes to their company’s private fork of a FOSS project, that can then sometimes be upstreamed.)