Big failures like OpenSSL fiasco happened - where sure, company was sustainable but due to skewed priorities coz of funding (companies that founded it founded features that from perspective of any other company were bloat, and not enough work went into modernizing the code) the code was shit and full of traps.

And it's still a fact that vast majority of developers of stuff used everywhere wouldn't be able to do it as full or even part time job for financial reasons.

All while the corporate is pushing same "BSD/MIT good, GPL bad" agenda, coz they don't need to contribute anything back to stuff they take