This could be Berkson's paradox (https://en.wikipedia.org/wiki/Berkson%27s_paradox) in action. Larger projects probably have more toxicity than smaller projects and are more likely to have a CoC. The result is that the two factors appear to be correlated even if they are independent variables.

It would be illuminating if you could back that up with examples

We’re almost there, I’ve blacklisted all OSS with CoC from our products/services.

We’re down to the last 2, in house rewrites have replaced the rest with superior performing alternatives.

I would normally support pushing our clean sheet rewrites MIT, but I need a license that prohibits the addition of CoC in all derivative/downstream/forks.

In the mean time I’ll settle for a competitive advantage.