Yeah, very good points. A while ago there was talk about some kind of foundation where maintainers could bill their hours and people and big tech companies could donate. Not sure if / how that would work ...
During the xz incident I also talked about this on Mastodon and someone suggested that big tech could just employ maintainers without them having to do anything for the company directly, just work on the project / library the company uses. Again not everybody would want to do that ...
I'm afraid there's no easy one-fits-all solution here.