On April 7, 2014, CVE-2014-0160 aka Heartbleed was publicly disclosed. At the time, 66% of websites used OpenSSL (via Netcraft). Also, OpenSSL had 1 full-time engineer, and only a few volunteers. Yearly donations were about $2,000. 17 days after Heartbleed Jim Zemlin from the Linux Foundation as well as thirteen companies stepped up to the plate and created the Core Infrastructure Initiative and pledged to donate $100,000 a year for 3 years to help prevent the next Heartbleed.
The point is this, Open Source isn't free. Docker, GitLab and other 'open-core' businesses stand on the shoulder of giants. If they raise a round of fundraising or whatever Press Release hits the wire, they get praise (which is fine, I love it). But the only time a project like the OpenSSL project gets press is when something goes wrong which I don't think is fair to them.
We can keep being reactive or we can start being proactive. I believe YC has the capital and influence to change this thinking of Open Source doesn't cost anything.