Ultimately, this is just part of the big picture that FOSS *operators* have always been guided by. "I want software that, for all the rough edges it might have, is made with good intentions by people who are not actively attempting to screw me over (and will not in the future), because there's a lot of software in my life, and I do not want to spend my finite afternoons continually *reacting* to malfeasance, post-malfeasance. This is my proactivity." That's not some new social contract - it was so widely and implicitly accepted that it led to the trust issues in the design of most of our package managers, that you ask for software by its name and let the ecosystem's guardians figure out which fork is correct, that you can assume the package is not malicious without reading every line of it yourself, that you can and should blindly install updates from upstream and these will increase your security instead of decrease it. We have bad actors in that space because it was a beautiful succulent commons to eat.