Except that it's not really true, since open-sourced applications can and most definitely have changed maintainers. And even if they don't, there's still a risk

Except that it's not really true, since open-sourced applications can and most definitely have changed maintainers. And even if they don't, there's still a risk. Do I need to remind everyone of the xz incident when it's so recent?