Most of the big FOSS projects depend on their core contributors being paid to work on them. Most sports teams pay highly too. It doesn't mean that most people playing sports are playing on a professional team. It also doesn't mean the professional teams pay their fans anything—despite said fans doing, in aggregate, as much (in PR et al) to earn the team their high pay scales, as the team itself does. Both big FOSS projects, and professional sports teams, are long-tail efforts, with a hard line between the core contributors (paid) and everybody else who helps (unpaid.)

Also keep in mind that many critical FOSS projects aren't big. Many are one-man shows. HN has a habit of frequently "finding out for the first time"—to much amazement and distress each time—that some project everybody's using is just kept alive by one person in their spare time.

>Also keep in mind that many critical FOSS projects aren't big. Many are one-man shows.

Absolutely. That's why the Core Infrastructure Initiative was created a few years ago for example. While I haven't made an exhaustive study, my sense is that the situation is at least better today than it was a few years ago, especially with respect to security issues. Though always more work to do to support developers working on critical infrastructure of course.

Yes, there is a long tail on projects like the Linux kernel. But a lot of that long tail doesn't individually do a lot of work. And, according to the seemingly latest Kernel development report that I have: "Well over 85 percent of all kernel development is demonstrably done by developers who are being paid for their work."