That would probably be better at providing funding for OSS. For projects that aren't backed by a company that sells support, customers could pay a third party company like Red Hat, Canonical, Tidelift, Collabora, etc. to certify the security of dependencies.