A recurring discovery, each time treated as news: some component that a large share of the internet depends on is maintained by one person, unpaid, in their spare time, and has been for years.
How this happened
Gradually and without anyone deciding it. Someone solves a problem and publishes the solution. Others use it. It becomes a dependency of something larger, which becomes a dependency of something larger still.
At no point does anyone assess whether the person at the bottom of that stack is supported. The software is free, it works, and the arrangement is invisible until it breaks.
Why it is a security problem
An exhausted, unpaid maintainer is a target. There have been documented cases of long-term social engineering: someone contributes helpfully for months, gains trust, is granted commit access to a project whose maintainer is relieved to have help, and introduces something malicious.
That attack works specifically because the maintainer is overloaded. A well-resourced project with several active reviewers is much harder to compromise this way.
Abandonment is the other failure. A project nobody maintains still gets installed by everything that depends on it, and unpatched vulnerabilities stay unpatched.
What has changed
Some funding, from foundations and from large companies that finally noticed their dependency graphs. It is real money and it is small relative to the value being captured.
Regulation is starting to matter more. Rules requiring software bills of materials force companies to know what they are shipping, which at least makes the dependency visible.
What has not
The basic asymmetry. Companies with enormous revenue depend on work by people receiving nothing, and there is no mechanism that routes value backwards.
If you build commercially on open source, the useful action is boring: fund the projects you depend on, or assign someone paid time to contribute. Both are cheaper than the incident.