"Critical" projects and volunteer maintainers

> I do agree that more of the problem needs to be pushed on users of libraries. Developers these days add anything at all to their dependency tree without much care about what they are importing. Getting developers to think about what they depend on and what their support needs are is important.

This is already required in some big (hence slow?) companies and there's also progress at the regulatory level, search "Software Bill Of Materials".

Security catastrophes and other scandals move things in the right direction... very slowly.