You bought up a lot of points. And I think they are all negligible, compared to the gigantic elephant in the room.

Which is, in order for some rando to fix the bug; a company would need to give access to their codebase to some rando.

And they don't wanna do that.