The internet runs on free open-source software. Who pays to fix it?

Who pays? Well, there is a large list of sponsors on the apache project website (which log4j is a part of): https://www.apache.org/foundation/thanks.html

Who fixes it? Well, I don’t see anything inherently broken. That a bug like it could happen in any other commercial software too. It’s already fixed btw.

Many major open-source projects actually have commercial contributors who actually see the value in the software.

Of course, many; many do not - but I’m seeing it happen a lot more often these days, which is nice. :)

FOSS software is not necessarily "unowned". Any asset or resource must be assigned to some entity. Typically one has to dig for the fine print that leads to the osner.