I don't really think it depends on people working for free. The salary of a single person working on curl could be absorbed by any of a dozen companies (or foundations, like the Linux Foundation or Apache) without blinking. And I don't think there's enough pieces of software like this to really change the math.
Yes, right now, there are places where work isn't getting funded, but if that lack of funding ever actually causes critical work to go undone and then get noticed, the money comes out. OpenSSL and Heartbleed showed us that.
People have noticed that the ways that this money gets disbursed tends to concentrate power away from the community and towards commercial interests (which is where I think a lot of the systemd hate really comes from, the fact that Red Hat is making those decisions and not the community), but the money seems to be there for infrastructure projects in the long run.
Yes, right now, there are places where work isn't getting funded, but if that lack of funding ever actually causes critical work to go undone and then get noticed, the money comes out. OpenSSL and Heartbleed showed us that.
People have noticed that the ways that this money gets disbursed tends to concentrate power away from the community and towards commercial interests (which is where I think a lot of the systemd hate really comes from, the fact that Red Hat is making those decisions and not the community), but the money seems to be there for infrastructure projects in the long run.