I'm not talking about your small hobby project with a few dozen users - as good as it may be, the internet doesn't run on it. cURL is really an exception, not the rule.
I’d argue without trying to classify and quantify Debian contributions, there is no way to know who is doing work on Debian on their employer’s dime.
I also try to contribute to various projects in spare time as well. My contributions don’t really add up to much overall, though.
Sure, it’s all anecdotal. But otoh, the notion that FOSS is mostly volunteer work is probably worth challenging. Most non-huge projects I’ve come across only have 4 or 5 key contributors. Open source is at least, not as distributed as believed for most projects. On the other hand, companies using FOSS have incentives to contribute, and sometimes will even hire contributors on important projects.
The spring framework has contributions from many volunteers, but most big contributions and all of the integration work come from Pivotal.
The contributions to the linux kernel are graphed here:
https://www.extremetech.com/computing/175919-who-actually-de...
80% of new contributions are from companies. That shouldn't be surprising at all, because these companies are also the biggest users of the project.
As for myself, in the rare occasions I contributed a patch to an OSS project, most of the time it was to solve a problem I encountered at work, so I have anecdotal evidence that at least some from the category 'volunteers' also got paid to write that code.