It's interesting that EC is not looking at addressing the obvious loophole big corporations are using - that is they are saving on R&D and tax by using open source software without paying the developers for their time.

If these big corporations were paying up the fair share of profit generated by the open source software they use, I am sure the developers behind it would have funds essential to ensure the security of the software they make.

That being said, even if above was not feasible (shame!), then it should be up to corporation using the software to ensure it is secure (and possibly contributing any fixes back to the software).