Yep, it really isn't hard to understand. But people don't want to understand, they want to have critical infrastructure code for free, and also with guarantees

Yep, it really isn't hard to understand. But people don't want to understand, they want to have critical infrastructure code for free, and also with guarantees even though every open source license in existence includes zero guarantees. If you want guarantees, you need to put them in place yourself, or pay the maintainer to give it to you. There really isn't anything else to this debate. Stuff like `cargo vet` is just trying to circumvent the issue by making it easier for users of the free labour of others to associate and vet updates, still avoiding paying anyone else but themselves - which may work in some cases, even when it seems to de-value the actual authors of such work as being in need of the veto of somebody else, but we'll see.