I believe that FOSS maintainers can gain financial independence and sustain their projects by "selling" hardened FOSS projects (think supply-chain security assurance) to consumers. I'm working on enabling this. DM me if interested.