Everyone who has ever contributed to an open source project _could_ be (in the absence of the project setting up proper legal structures) considered a membership of a general partnership, and thereby become jointly and severally subject to unlimited liability for the actions of the partnership.
(IANAL this is just what I've read online)
Outside of a project that takes contributions / donations without a legal entity to receive them and parcels those out amongst the contributors, I can't think of a reasonable situation that would enable such a definition.
I managed to dig up the mailing list thread where I read about this risk: https://groups.google.com/g/linux.debian.vote/c/Nl-J8h2pO9A/...; for context, Sam Hartman is a former Debian Project Leader and I assume his opinion is formed by advice from SPI's lawyers.