Nobody claimed that. Paying maintainer is a start. Ideally any "important" project would have organization behind it, with some people ready to react when secu

Nobody claimed that. Paying maintainer is a start. Ideally any "important" project would have organization behind it, with some people ready to react when security problem hits (even if usual maintainer/developer takes well-deserved vacation) but the whole problem is convincing corpo it's worth investing outside of disasters like OpenSSL which was essentially paid to make code worse.