alt Hacker NewsWell, I think this is what SchedMD do with Slurm? GPL code. You can sign up to the bug tracker & open an issue, but if you don't have a support contract they close the issue. And only those customers get advanced notice of CVEs etc. I'd expect nearly everyone who uses it in production has a support contract.
I think too many people just won't sign up for a support contract, especially if you're charging a lot for it or the product is consumer-oriented.
But a reasonable cost for the product itself, that's maybe not as high as a support contract (but comes with some support), might work better.