That has always been the case with anything self-hosted. Otherwise you're putting a lot of faith in an upstream maintainer to actually put in the effort which they may or may not be doing.

always has been

when the software is supposedly maintained, too