This seems like a great way to invest in supporting open source projects in meantime if these projects are being used by these actors. Just have to maintain an internal fork without the backdoors

Maybe someone can disrupt the open source funding problem by brokering exploit bounties /s