For corporate users of open source, yes, this does lead to a responsibility to check that they’re using good stuff. But again, it will boil down to specifics. If your whole data rights strategy hinges on a broken anonymising function that you didn’t check, you’re toast.
♥ 1