Maybe we need an international NGO/co-op to provide essential services for small, essential FOSS projects such as security comms, security audits, build infrastructure, testing, best practices, background investigations, and so forth.

The "one guy's little piece of code holding up the world" is a SPOF and much easier to attack than if they had some help and automation.