So much for "many eyes make all bugs shallow" I guess. Problem is that 99% of those eyes are turned only toward using the product of someone else's good will fo

So much for "many eyes make all bugs shallow" I guess. Problem is that 99% of those eyes are turned only toward using the product of someone else's good will for their own personal profit. And 99% of the remainder are only looking for bugs in the features they use, or just aren't that good at spotting bugs. This only gets worse in environments like NPM, which make it easy for dependencies to proliferate beyond anyone's expectations, so people don't even know what code they should be looking at. This is still better than the situation with proprietary software, but problems like these are kind of inevitable in an ecosystem where people typically write 5% of the code themselves and blindly pull in the other 95% from who knows where via unchecked package dependencies.