1. Let's baseline the usage and spread first. What code is used, where and by whom. It ought to be possible to get complete pictures of this most large orgs scan their whole estate constantly - but publishing it academically?
1.a. A central "phone home" FOSS library that everyone "trusts" will just report the minimum might be a good idea here.
2. So if we know what codebase are critical we can then ask are they supported? Are the top five contributors paid in connection with the code base? Lots of ways of finding this about but email or bug requests is most likely winners.
3. A move I think is a good idea is to have some form of "Foss Tech Support Mesh" Library X is really useful, so several ISVs announce they support it, understand it etc. Maybe if an ISV account gets a commit accepted they get a badge. This will start to bridge the gap between volunteers and paid positions.
while we are at it, what is the proprietary story? I am pretty sure Facebook has funds to keep its codebase updated, but there were MRI Scanner companies that cannot afford to move off windows XP, so there is bound to be a grey area of for profit companies producing code at not much more than subsistence level.