I'm being naive probably, but I have a hard time believing that this controversy would be so big had it been a case of an abandoned library. Users do whine a bi

I'm being naive probably, but I have a hard time believing that this controversy would be so big had it been a case of an abandoned library. Users do whine a bit in the Github Issues for dead projects, but at least they can tell the project's dead and/or broken. In this case, the maintainer, who is a security professional, made the active decision to give ownership to an untrusted party. He shouldn't be held liable in any legal/financial sense, but why wouldn't users be alarmed/unhappy?