Based on https://github.com/apache/httpd/commits?author=covener, either the committer never writes tests, or this project just doesn't do testing at all. Nothing here would pass a code review at my company. Totally insane.
The attacks on OpenSSL maintainers ten years ago were disgusting, and I think we've learned nothing since then.
I didn't register the attacks, but I'm sure there were some when you say it.
I summarized the blame on that incident xkcd's wording:
"some random person has been thanklessly maintaining since 2003"
And ASF does receive funding, by the way, even if not much (slightly less than two and a half million USD in 2024).
A quick eyeball of the projects list looks like about 100 projects: https://projects.apache.org/projects.html
So each project gets funded enough for 10% of a developer. That's not enough to provide infrastructure to commercial users satisfaction.
Apache HTTPD still seems to run about 17% of all sites, plenty of those probably make money using the software. https://www.netcraft.com/blog/january-2025-web-server-survey
Open source is open, so naturally people can use it but the ecosystem has also been at a breaking point for years and bad actors has caught the scent of that.