Their commercial users have auditing budgets.
I might like to live there.
https://openssf.org/tag/google
"But that's Linux, how small libraries get audit budget..." fortunately LLM has eliminated the need to have small libraires in your dependency chain.
I take back the “I might like to live there” :)