It's a bit dubious that paying maintainers more will make them write more secure code. Certainly professional developers who write closed source have produced p

It's a bit dubious that paying maintainers more will make them write more secure code. Certainly professional developers who write closed source have produced plenty of vulnerable code in exchange for their six-figure salaries. If you're really concerned whether a particular open source package is secure, it'd make more sense to pay a third party to audit it than the maintainer.