> our investigations have not evidenced any resulting real-world harm.

Pressuring open source maintainers is fine then.