Yes. Free OSS is like “I build bridges for free as an architect” or “I dig wells for free in Africa.” It may be free but we still need to ensure its security.
And this is how, I believe, AWS will become kind of required, as it will be the only way to get a certified-up-to-date version of a Linux, of a database, of a library, etc. And programmers will only be responsible for the glue code between those services.