> we could demand and verify good testing and analysis for foundational bits of code, but we don't.
Who would you take these demands to? Most foss software is written and managed by volunteer maintainers, if you start demanding things from them they will rightfully tell you to jog on.
Even when they are not volunteers, they are likely employees of companies that fund this development largely because they require and rely on the software. In which case, they likely have priorities set that are aligned with that company and the needs of other users are low priority at best, but more likely largely irreverent.