Mythos found the bugs. Who pays for the fixes?

"Who is going to fix it?"

Is this not the central maintenance question in all open source development and 0-day discovery?