Apple, Google, AWS, Microsoft, ... I would call it criminal neglect using hobby software like libxml2 written in a memory-unsafe language (to cite the maintaine

Apple, Google, AWS, Microsoft, ... I would call it criminal neglect using hobby software like libxml2 written in a memory-unsafe language (to cite the maintainer) to process untrusted input in systems that need to protect personal data or are even safety-relevant. So what's the alternative? Microsoft has a longer history than many open source components. Nobody could see the source, but it was proven continuously that it was highly insecure. Less than hobbyist quality, but closed source so nobody could see the (lack of) quality explicitly. Some might claim 20 years later they would produce better software. Maybe marginally, but not fundamentally I'd dare to claim.