I don't really see how paying the maintainers helps against insider threats. The users still has to ensure that the software is safe. Paying the maintainers is

I don't really see how paying the maintainers helps against insider threats. The users still has to ensure that the software is safe. Paying the maintainers is nice, but I think the megacorps and governments has to fund an organization that does security audits of all the sensitive packages, instead of heaping yet another job on the shoulders of the maintainers. It's especially important to not saddle the developers of open source with red tape, most of them would think that getting paid is poor compensation for the lost freedom.