[proprietario]

But this is exactly the point (which I think is good). This whole thing is applicable if you produce software commercially, regardless if OSS or not

I read it as this: In effect, if you make money of the software you destribute you are responsible to address security issues

I hope that this is a change for the better. Now everyone who piggy-backed on some OSS project so far has to either maintain a fork (-> more contributions) or provide incentive for the dev to fix it (money?)