What's the better solution?

Also, what's an example of this rent seeking in open source you're talking about?

> What's the better solution?

IMO Writing correct software the first time around - so formal methods.

But the tooling isn't there yet (though lightweight versions, e.g. strong type systems like rust's, are and significantly reduce the security issue load).