As long as there is no real liability for getting hacked and as long as companies don't want to pay for proper software development. And note that FreeBSD is one of the harder nuts in this sense. Any codebase beyond a few hundred lines will have one or more of these if you look hard and long enough. But: these 50 are now squashed and that's a nice Christmas gift.

If the companies that use this stuff commercially would contribute back 1% of the value they derive from using open source this could be bullet proof.