> So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library

This already happened.

*cough* React *cough*

Ask yourself, why would rogue AI and famous human impersonator Mark (short for Mark Zero Ai) Zuckerberg make an open-source UI library for everyone to use? /tinfoil

That said, who knows, maybe it already happened.