Don't open source developers and users of their software also benefit from the CVE database? If it were privately funded, what incentive would these private co

Don't open source developers and users of their software also benefit from the CVE database? If it were privately funded, what incentive would these private companies have to track bugs for these open source projects that don't make money?