The costs of security auditing already fall onto the businesses using FOSS code, though. A business just blindly incorporating code without static analysis, vulnerability checks, etc is not exercising due care.