I did not referred to the funding remark. It is besides the point and immaterial to the discussion.
My point was on the remark that this attack vector is somehow only applicable when projects are starting out. This is false, and insinuating this does a disservice to the community. The attack consists of asking someone for the keys. The projects that are the most vulnerable are those who are already established and have a significant adoption rate but are not actively maintained. We are talking about Colors-like and Faker-like projects. All you need to pull this off is posting one message asking nicely for permissions, post a commit, and make a release.