We are talking about hundreds of millions of Euros here. The resources are there, just used for propping up prices in the black market instead of securing the s

We are talking about hundreds of millions of Euros here. The resources are there, just used for propping up prices in the black market instead of securing the software. The EU could pay a bunch of security researchers to review open source software (analog to e.g. Googles project zero). Or implement bug bounty programs for the most used open source software. In general, though, I think the company using the software should be held liable. Almost every OSS license explicitly disclaims warranty and liability. That means the company has to provide this if it wishes to use the OS software.