This model just doesn't work and that's exactly what the paper linked in the OP is about. Look at OpenSSL, everyone was (is) using it, one guy was maintaining it and barely earning a salary to do so.

Seriously, read the OP, it's well worth your time and makes an extremely solid case. It's both well-researched and well-written.