[throwaway0129u]

True.

If someone clearly describes their project as an experiment or a hobby project then no responsibility should be attached to it.

But if they advertise it as something production-ready or secure they are capturing user's trust, attention and time.

Some company-driven projects even use open source as a foot in the door to get user's data or corner a market and charge money later on.

As a developer your time is valuable and users should not be demand it.

As a user your trust, attention and time are valuable and not every random project on github should get it.