[aflag]

I didn't do any quantitative study, but I'd be really surprised if most maintainers in the project are not volunteers. Those contributors, though usually individually small, tend to add up. It's also probably difficult to justify Debian package maintenance to your employer, unless you work for canonical. Even products that distribute a .deb tend to do it outside of the distribution, rather than really contributing.

[jchw]

Actually, there's certainly of reasons you might do maintenance work on company time. At Google for example, the gLinux distribution is heavily based on Debian[1]. Why would individuals do it on company time otherwise? One example is to solve a business problem. I have definitely contributed upstream to open source projects to solve problems at work.

[1]: https://en.wikipedia.org/wiki/gLinux

[wobbleblob]

I haven't done a quantitative study either, but here are two examples of extremely influential open source projects that the internet runs on:

The spring framework has contributions from many volunteers, but most big contributions and all of the integration work come from Pivotal.

The contributions to the linux kernel are graphed here:

https://www.extremetech.com/computing/175919-who-actually-de...

80% of new contributions are from companies. That shouldn't be surprising at all, because these companies are also the biggest users of the project.

As for myself, in the rare occasions I contributed a patch to an OSS project, most of the time it was to solve a problem I encountered at work, so I have anecdotal evidence that at least some from the category 'volunteers' also got paid to write that code.