Convincing project managers to tackle tech debt is hard enough. Contributing to open source won't even reach the middle ear unfortunately.

Let’s not even get legal involved…

Don't worry, legal will answer a completely different question that's unrelated, but rests on a fundamental misunderstanding of the entire premise due to a combination of misinterpreting technical jargon as plain English and then misapplying a legal generalization, resulting in absolutely essential advice that needs to be followed immediately, which is couched in legalese that the techs will proceed to misunderstand by misinterpreting legal jargon as plain English in combination with a misapplied technical generalization, resulting in an absolute quagmire when it turns out that these essential compliance steps turn out to have a minor impact on the next quarter's bottom line. Thus some even more obtuse interpretation will be dreamed up by some manager to claim CYA without hurting the bottom line (or addressing the reinterpretation of the reinterpretation of the reinterpretation of the original issue). The issue will be resolved, pending small details like the actual legal risk and technical issues, and all will be fine.

But just be be sure, we should ask legal!

If it's an enterprise (https://zwischenzugs.com/2018/10/02/why-are-enterprises-so-s...) the latter will be a much easier sell to management. Paying for support is a given but contributing developer time will require many approvals from different departments if it can be done at all.