Does any one really say this?
Every user has the potential to hack on it if they’re willing to put in the time and effort to getting up to speed with the codebase but the license doesn’t guarantee that right.
In fact they generally provide it “as is” with no expressed or implied usefulness.
So no mandatory security audits, no mandatory documentation, no onboard team to help the junior-woodchuck devs, nada. If it breaks you get to keep both pieces and if you manage to fix it you might be liable to share your changes with the rest of the world, depending on licensing and what you’re doing with it.
Requirements which make the developers responsible for anything more than what they want to provide will just kill open source because they also have the freedom to not labor for free if they choose not to. If they have to get approval from The Commissar of Free Software before every upstream push, well, silly argument but it makes the point.