No person, ever, has a duty to fix security issues in free software with a no-warranty license. If you want your security fixes, pay for them.