Many companies contribute to open source software, would they be responsible if some random user of Linux leaks some data due to a change redhat implemented? De

Many companies contribute to open source software, would they be responsible if some random user of Linux leaks some data due to a change redhat implemented? Despite that user having signed no contract with them? And last time this came up it seemed widely believe that a donation link is commercial activity.