These are sort of the exception that proves the rule, though. Corporations don't want to rely on poorly supported OSS projects, they prefer to pay for support s

These are sort of the exception that proves the rule, though. Corporations don't want to rely on poorly supported OSS projects, they prefer to pay for support so they can hold someone accountable for fixing it when it breaks. OpenSSL was a bit of a blind spot in this regard. I think corporations just didn't realize they were depending on it and/or how much of a risk factor it was, they learned that the hard way.