The real problem for a spiteful move like this is that it's unlikely to make people want to support his open source work at the risk he'll later destroy it, and

The real problem for a spiteful move like this is that it's unlikely to make people want to support his open source work at the risk he'll later destroy it, and companies are unlikely to want to employ him because of fears of him sabotaging the code base if he ever got upset and left on bad terms. I can't really see any positive outcome for him personally on this, although ironically any of the big companies he's talking about are learning the lesson not to trust other people's code updates without auditing. But maybe this will change the mindset in open source package managers that updating to the latest version is always best. The older approach of something like git submodule and sticking with a tried-and-tested version until you make a deliberate choice to update seems much more appealing now.