i feel the root cause here is that computer security companies have eleventy billion trillion dollars to spend on vuln research, whilst your average open source project's security budget is ten bucks and a half-empty can of monster someone left in an office fridge