"Critical" projects and volunteer maintainers

The short of it is that it looks a lot like "beggar barons" move to me.

If a company cares about the security of its supply chain so much, it should create paid positions for people to take care of it. And no, enlisting volunteers to do it all for free doesn't count.

Oh and also they should reckon with a possibility that the maintainer will refuse even the money and will not give a crap about imaginary obligation somebody on the internets thinks they have.