There's the "demand" word again. Who is that demanded something from the maintainer, and where? I saw no indication in the original bug of any demands from big tech companies.
(Just the act reporting a security issue is not a demand. A verifiable bug is a bug whether it was reported or not, and reporting one is a contribution.)
When the demand part of your torrent-inspired equation is zero, how is it leeching? It's just zero, no matter what the earnings are.
https://gitlab.gnome.org/GNOME/libxml2/-/issues/905#note_243...
Modern tech business models make you pay a tax to not waste mental energy on their BS games and it gets exhausting. So you stop and resent the companies for ripping you off/manipulating you. I hope that frustrations comes back to bite them and instead of being special darlings with regulation carveout's they become the most regulated industry.
It will probably work for both sides, as the only people left are either ok with that or clueless, perfectly self selected.