This is similar to electronics supply chain. If you source from shady component distributors, you’re going to get bitten with something like a faulty capacitor

This is similar to electronics supply chain. If you source from shady component distributors, you’re going to get bitten with something like a faulty capacitor with an annoying frequency in volume. The difference here is that a single vulnerability can take down your entire app or worse. It’s like sourcing components that can potentially do irreversible fire damage to your customers. This is why they rely on trust worthy distributors and manufacturers. Without payment incentive and with high expectations for free stuff, this is not possible to solve. Billion dollar companies building on people’s hobby projects. In any other industry, this would be unprofessional.