unless they're using some sort of hosted service for free, this cannot be critical. After all, software doens't rot, and they could continue to use the existing release until a (new) solution is found.
Look at how crowdstrike triggered outage didn't cause bankruptcy - that is more critical than most OSS would be.