Can't their interests be aligned with the oss developers?

Google has project zero and Safe Browsing API which does helpful things to me, GitHub auto scans dependencies, and owasp guidelines are helpful I think