This is grossly over-simplified, but if we accept the notion that businesses can have real liabilities if they get hacked, then they're going to want insurance and the insurance companies are going to want to drive rapid improvements in quality in order to reduce the number of claims. This effect has been a significant factor in improvements in safety in a wide range of other industries.
What would the insurer regard as low-risk? Typically, they would use two things:
1) Past experience - have they seen this piece of software regularly exploited?
2) Formal assessment in an underwriters' lab - do relevant experts consider the software to be well-constructed? Here open-source software has a real advantage, because the underwriters can review the source code directly, or pay others to do so. They have access to any automated tests and code coverage assessments, and so might assign a lower risk score to a project with more tests. They might even assign lower risk to projects written in languages that are known to produce safer code, so with all other things being equal a Rust codebase would be cheaper to insure than a C++ one.
This is entirely compatible with a system of bounties or rewards for anyone who moves the project in the direction of safety and high-quality maintenance. By concentrating the risk associated with poor software quality on the insurer, we get around the problem where many different companies use the software but are unwilling to pay for its maintenance. The insurer has a greater incentive to care than they do, and so would be more willing to pay developers.
I admit that this is a back-of-a-napkin sketch, but the incentives do seem to line up correctly.
If you want to force people to contribute back if they distribute, make your software Free, if you want to force people to pay you, make your software proprietary.
It is perfectly possible to charge for open source software.
I mean isn’t this what a software patent is for? And you guys hate those. It’s how you are properly compensated for your inventions.
Giving away your software to small business and individuals has nothing to do with Open Source, Microsoft (among others) does it with some of its biggest products that it later charges your firstborn for after you get past a certain size. If you want to do this, just do it.
The contributors to oss are in a tricky spot. Look at what happened with AWS forking Elasticsearch, sure there were reasons, but it seems like there's a gap in the licenses at the moment, that doesn't account for the scale things like ssl play in modern life. Whatever legal terms you'd use, you'd want to aim to not scare small companies in the hope of anchoring a income stream when the scale and find our the oss clause kicks in.