…or it’s the gremlin who tries to get by, but only has like 30min a week for his project, since he has a day job and two gremlettes to feed.

See the xz debacle.

The underlying problem is, that there’s no monetary value being assigned to good software. As long as it’s good enough to sell it and buy insurance, that’s fine.