> You sound as if the only answer that would satisfy you is "we'll turn back the clock".

There are methods to manage risk that don't involve turning back the clock. The open source creators /and/ shady companies have responsibility for the tooling they release, just like any other company has responsibility for any potential harm, be it to the environment, infrastructure, or the public that they create.