One big problem that I see with the current system is, that - like everything in capitalism - it works with the attention economy. Big projects with many functions (like computing platforms) get much attention, especially from companies, who donate and contribute for their own good. But there are many small projects, often small libraries, that are developed by single persons for free, but used everywhere. If I remember correctly the disaster with log4j was such a case. Real developers surely know even better examples. The funding of such widely used software can effect the security of our whole IT stack.