What if you want implement a feature, but they don't have time to look at it and make sure it's secure, or support future bugs? Look at the xz (IIRC) hack - not everyone has tons of free time.

How long after they release their code are the required to keep this up? Do they need to respond to your requests within 5 business days?

If they retire / move on to another project, does the source code stop being open source?