What law mandates that companies can't donate to someone on Patreon or help triage bugs or dedicate QA/security time to identifying issues? What law mandates that companies have to ignore maintainer burdens? Each company made an individual choice to use infrastructure that they weren't funding/supporting, to effectively transfer bug-testing and security reviews onto unpaid maintainers. Then the infrastructure they weren't supporting broke.

The mistake I'm trying to point out is in looking at a corporate problem, where corporations are not doing due diligence to ensure the success of the commons that their own products critically rely on, and then implying that it's the responsibility of Open Source maintainers to make it easier to fund them or to alter their culture/projects to better fit company priorities. Well if everyone relies on this stuff, then the people who rely on it can figure out how to support it.

That I'm seeing articles suggesting that the problem is that Github sponsorships are hard to explain to accountants -- well, it sounds like the giant accountant firms that are being paid a lot of money aren't doing their jobs well, and aren't actually able to navigate financial situations that are outside of their comfort zone. But that's not the Open Source community's problem to solve, and the law doesn't mandate that companies be unable to navigate those spaces.

Companies ended up in the situation where an undersupported library that they needed to be stable instead broke because of their individual choices as companies about what parts of their infrastructure they would and wouldn't fund/support.

There is a systemic problem here, but it's not systemic in the exact same way as many other systemic problems that we face -- it's not systemic primarily due to outside pressure or laws, it's only systemic in the sense that companies are systemically and culturally unable to think about infrastructure or the commons in a responsible, long-term way. Sometimes systemic problems are really hard and complicated, but sometimes there are systemic problems that basically boil down to, "a bunch of people are irresponsible, and if they stopped being irresponsible the situation would get somewhat better." I don't think that Minecraft is the victim of circumstances outside of its control, I think it's really reasonable to expect a game bringing in that much money for Microsoft to be able to look at its dependencies and proactively identify/reinforce fragile parts of their infrastructure. Minecraft wouldn't have needed to solve the entire Open Source funding problem to avoid this bug, they would have needed to figure out how to support the extremely finite number of libraries that they rely on and that are directly linked to the success of their product.

And we can talk about wide-scale problems that hold Open Source back, we can get into the weeds on concepts like UBI, or better payment platforms, of IP laws, or whatever. It's not that those conversations are bad to have or that they're not important in their own ways. But they're not prerequisites for Microsoft giving money to people. And even in a world with full UBI or in a fully post-Capitalist society, you still might have Open Source developers making really useful stuff, where those developers don't want to spend all of their time or energy on that project or want to take it in a narrow direction, and that's fine. That shouldn't be a situation that we're trying to eliminate. Open Source is accessible and it allows people to dip their toes in, to solve narrow problems, to pick up and port/extend other libraries without a complicated legal process, to collaborate across national borders, to evolve their priorities and to jump between or even abandon projects -- and it turns out despite everything that is a really great ecosystem to live in. I don't think it's right to try and tear that ecosystem down and rebuild it into something that's purely professional, which is what I think a lot of corporations want. I think it's a lot more reasonable to ask businesses to learn how to interact with and support developers who may or may not be professionally working full-time on each project; I think it's more reasonable to ask why when the Open Source community is building stuff that other people find useful, that it is also our job to figure out how to make funding us attractive. And more directly relevant to your argument, I don't believe that there's a legislative reason why companies like Microsoft/Google/Apple can't get better at this stuff right now.