I expect we're about to find that it's a lot easier to convince a company to spend money running an AI security scan of their dependencies and sharing the results with the maintainers than it is to have them give those maintainers money directly.

(I just hope they can learn to verify the exploits are valid before sharing them!)

Their commercial users have auditing budgets.