> have been reviewed by multiple security org/researchers

I imagine reviewing all the code for all the packages for all the published versions gets really expensive. Who's paying for this?