True. If someone clearly describes their project as an experiment or a hobby project then no responsibility should be attached to it. But if they advertise it

True. If someone clearly describes their project as an experiment or a hobby project then no responsibility should be attached to it. But if they advertise it as something production-ready or secure they are capturing user's trust, attention and time. Some company-driven projects even use open source as a foot in the door to get user's data or corner a market and charge money later on. As a developer your time is valuable and users should not be demand it. As a user your trust, attention and time are valuable and not every random project on github should get it.