I agree that's a risk. However you likely can do soft forms of development on company time such as reading documentation and code, pruning / responding to issue

I agree that's a risk. However you likely can do soft forms of development on company time such as reading documentation and code, pruning / responding to issues... Additionally it's going to be hard to argue against(or sue) if you're improving a FOSS that your company depends on and benefits from a feature you add.