“As of yesterday, the maintainer who patched the vulnerability had three sponsors on GitHub : Michael, Glenn, and Matt.”
Log4j runs inside Apple, Minecraft and half the enterprise world. The maintainer who patched it had three sponsors. ua-parser-js got hijacked with $41.61 raised in total. A senior engineer doing the same work at a company earns $150k or more. Tip jars are not a salary, and the companies shipping this code know it.