> And, of course, there is no requirement on end-users to run software from projects which do not consider untrusted-input-validation bugs to be high priority.

What's this even saying?

Then they're free to fork it and never use the upstream again.