$100M for RubyGems ought to keep the servers running for several years. A policy to pursue and spend such windfalls on security development would make the service antifragile.