Root cause analysis would likely also include the lack of threat modeling / security evaluation of their dependencies

Would likely also question the lack of resources allocated to these open source projects by companies with a lot of profits from, in part, using those open source projects.