That's part of my point. As long as the work is "someone else's problem," will it ever get done? If other opportunities are there for someone with a security

That's part of my point. As long as the work is "someone else's problem," will it ever get done? If other opportunities are there for someone with a security skillet, what makes a libfoo maintainer become skilled enough to make the most secure libfoo possible, but also stay on libfoo? Does saying "security is important" mean that security is important, or does it means "have my skillset, and also do the busywork someone with my skillset is able and happy to ignore?"