While users could help financially, a project should not delegate the responsibility of security down to users until they explicitly donate for that especially

While users could help financially, a project should not delegate the responsibility of security down to users until they explicitly donate for that especially for a project of this amount of user base.