Assuming they do proper due diligence and third party tracking just search the database for the ten libraries they use in the most places themselves ... and yes, that will need some time to coordinate, for identifying the right people in the open source project. But as they certainly depend on quite a few good relations is also in their interest to deal with security issues.

Apple could just donate a coupon or something like that.

Hmmm I believe Apple must have datacenter full of m1 powered machines for their CI/CD farm. Sending individual devices to individual developers working for n projects might be complicated, however offering a CI/CD environment to projects with ssh access to test virtual machines shouldn't be too complicated for them provided they were ideologically willing to help and cooperate the open source world.

Curl ships preinstalled on macOS, supporting such preinstalled tools would be a good start (I would hope that Apple has a list somewhere of all the OSS tools they are shipping with macOS).

Yeah my guess is they just don’t have a process for this. Sure, sending a MacBook to the devs of curl probably makes sense and costs virtually nothing. But everyone writing open source is going to want one next so you need some full process to approve requests.