Shipping malware is not a mistake. The amount of people simping for this guy is unreal.
Most contributions are from drive by contributor's that may not even use the project.
Neither those nor the maintainer are entitled to compensation, but open source is a cruel environment where people want to use what you made but they wouldnt give you a dime unless they had to
I wish it was otherwise, people, but it's usually "build it and they WON'T come" ("they" being the funds needed to make a living.)