The maintainer owes you nothing. One of the points of open source is that if you need something, you have the source. Fork.
If you want guarantees, you need to put them in place yourself, or pay the maintainer to give it to you. There really isn't anything else to this debate. Stuff like `cargo vet` is just trying to circumvent the issue by making it easier for users of the free labour of others to associate and vet updates, still avoiding paying anyone else but themselves - which may work in some cases, even when it seems to de-value the actual authors of such work as being in need of the veto of somebody else, but we'll see.
You really need actual programmers contributing. Ideally large enterprises would give time dedicated to this and help maintain more projects.
But everywhere I've worked (FAANG included) has had more managers than engineers so I can't see it becoming commonplace.
Seems way too many people (or organisations) have forgotten that.