This is an interesting story, and one which we may see more of in the future. Here is a company which is dependent on open source for a large part of the 'base' engineering load, and they have created an 'attractive nuisance'[1] with it which, true to form, attracted bad actors.

It puts an interesting 'box' around what sort of things you can build with open source and what you can't. Or more precisely how much you can leverage it. So leveraging the Linux kernel in your gizmo is fine, but if your gizmo controls something which crooks would like to control, and you don't keep it patched, you are liable for the crimes that the crooks do with your gizmo. Yuck.

[1] This legal term defines a setup which is something which encourages criminal activity.