I think of open source as a force of nature, sure you can create incentives in your own proximity, and if you are FAANG the radius can be huge, but finite. The fundamental failure here is not related to open source but in how software is integrated and isolated. We need more robust typing in the integration and capabilities to define the isolation.

Capabilities alone might have eliminated this whole class of failure to escalate, but not eliminate the initial injection failure. Pretty sure that could have been demonstrated on wasmcloud.dev