Open software gets abandoned all the time, its not magically immune to this. Open and standardised file formats are the win.
The point is you can, while with closed software, you maybe can and sometimes with a lot of trouble.
If the source is open, the file format is also open.
If the software were to explicitly depend on <vulnerable library> and moving to <patched library> broke it that would be the nail in the coffin for me / make me question whether I want to spend the effort maintaining the project.