"Who is going to fix it?"

Is this not the central maintenance question in all open source development and 0-day discovery?