What if you want implement a feature, but they don't have time to look at it and make sure it's secure, or support future bugs? Look at the xz (IIRC) hack - not

What if you want implement a feature, but they don't have time to look at it and make sure it's secure, or support future bugs? Look at the xz (IIRC) hack - not everyone has tons of free time. How long after they release their code are the required to keep this up? Do they need to respond to your requests within 5 business days? If they retire / move on to another project, does the source code stop being open source?