Overall, it seems pretty reasonable. The regulators seem to have understood that obligations should fall on the entities in the supply chain where money is made. They shouldn't flow upstream to open-source developers who do their work non-commercially. The stewardship role for better-resourced open-source projects focusing on information sharing also seems reasonable.