Can we fix this kind of behavior without spiraling down to a money-spending competition? (Which the open source community clearly cannot win?) With open-source

Can we fix this kind of behavior without spiraling down to a money-spending competition? (Which the open source community clearly cannot win?) With open-source developers being badly paid, large numbers of relatively unknown contributors with little to lose (ie no reputation, no criminal charges, no repercussions whatsoever), and major corporations not caring enough about Uncle Sam to spend $$ to shield open source software they use, who will stop this kind of decay? It used to be that the stakes were low, the developing community was small, and the amount of software was manageable. If someone introduced a zero-day, sooner or later would be caught and kicked out. Few people cared about breaking into this software so some donated personal effort was adequate to shield against those intruders. Now if you can remotely compromise Debian or Ubuntu you have millions of servers in your hands and potentially hundreds of millions worth of private data. I don't see how this can be stopped.