Widely used does not at all imply that they’re financially or otherwise sustainable. See the OpenSSL debacle which was at least partially caused by lack of paid

Widely used does not at all imply that they’re financially or otherwise sustainable. See the OpenSSL debacle which was at least partially caused by lack of paid maintainer time. It’s not like the lack of funding for large open source projects gets mentioned every time a major bug is discovered in one of those widely used open source projects (log4j maybe?) A lack of money also means that the pool of people working on public good (open source) projects self-selects to those that have the money to do that - and that’s limiting the pool and input into those projects.