And people are allowed to criticize his reluctance to accept those vital security patches, because he submitted code packaged as a crate to be used by others on a public registry.

By publishing something to be used by others in a public registry, you are opting in to receive criticism from the public.

Criticism is not the same thing as vitriol and I’m not endorsing the latter even one iota.

Is that not crystal clear to you?