(And on the flipside, nothing is owed for a bugfix the maintainer made out of their own free will. Again, a gift.)
For the library to be secure, there needs to be funding, not by magic and expecting maintainers will do stuff on there free will.
The assumed base state we're looking to augment via open source software being: "Fully working software"(Augmented: free) vs "No software" (Augmented: yes software)?
Like, what you seem to want is business, plain and simple. Pay a guy, have your specs filled, get guarantees. That would be expecting open source to fill a role it just isn't made for.