Ah, my fault. But that does not change the point I try to make: project ownership is equally important, if you cannot just fork and maintain some open source software yourself. It's something to include in risk calculations.