Open source can be fixed as if it was your own code. (And that is a strong tenant of free/open source software)

Not only do most open/free source libraries come without support agreements: they come with the broadest possible limitation of warranties. (As they should)

So the company, knowing that what they are using comes without any warranty either of quality or fitness to the use-case, have a very strong burden of due diligence / vetting.