Overall, it seems pretty reasonable. The regulators seem to have understood that obligations should fall on the entities in the supply chain where money is made

Overall, it seems pretty reasonable. The regulators seem to have understood that obligations should fall on the entities in the supply chain where money is made. They shouldn't flow upstream to open-source developers who do their work non-commercially. The stewardship role for better-resourced open-source projects focusing on information sharing also seems reasonable.