You're conflating negligence/dereliction of duty and bus-factor-of-one here, while Fosshost suffers from both, they are not the same thing.
Regulators can absolutely solve the former, but not the latter. The volunteers can solve the latter, but only after the former is resolved. I don't see why you assume why a new CEO would resist relinquishing all treasury duties.
I appreciate the distinction, but they're certainly related. We can see that because we can achieve the same result with a bus accident as with dereliction, and that addressing the dereliction without addressing the bus factor will result in a repeat of the problem.
> I don't see why you assume why a new CEO would resist relinquishing all treasury duties.
I don't, that was a thought experiment to illustrate the point that addressing the dereliction does not address the root cause.
There's certainly things I find suspicious about this CEOs actions, I won't deny that. I'm still not going to contact law enforcement about strangers on the Internet.