None of this means that "people" couldn't do better
There's quite a lot of vitriol in the discussions I've seen, particularly around whether or not FOSS developers "must", or should, address this kind of thing.
They're not about what the law (which law? applicable to whom?) demands, but around broader "musts" and "shoulds".
That, IMHO, requires nuance.
Plus, perhaps it's not just about the developers, and that people running services may too have some (non-legal) "musts" and "shoulds".