@jwildeboer tbh, companies (esp. the very big ones) should just stop being freeloaders and actually have internal staff doing reviews and testing. And for each bug (or security issue encountered) actually propose a fix upstream.

If your ROI or even just internal processes depend upon some open source project you should have at leat one developer reviewing that projects changes and stay in touch with that projects community AND also contribute hardening and security audits+fixes...