This. It's the vendors who mooch off the labor of others but then can't be bothered to fix their shit in a timely manner, especially the billion dollar "security" companies, that are the problem here.
FWIW I think PHP team did a good job with this. It’s a thankless job as it’s mostly volunteers powering the internet while almost everybody freeloads off ‘em, tale as old as, well, the internet.