The Xz backdoor and a near miss on the F-Droid app store show how the entitled attitude of some people in the open source community can be used to push malicious or insecure code.
Honestly, in medium to big projects, 2 seems like mostly astroturfing from companies who really want to hide the fact that they benefit financially but use alt accounts to push toxic bullying like “you’re not following opensource principle, not foss this, not foss that, you do this or we’re going to make a scene” when maintainers try to get any semblance of authority over their own projects.
Honestly, in medium to big projects, 2 seems like mostly astroturfing from companies who really want to hide the fact that they benefit financially but use alt accounts to push toxic bullying like “you’re not following opensource principle, not foss this, not foss that, you do this or we’re going to make a scene” when maintainers try to get any semblance of authority over their own projects.