I’m sceptical as to how well github sponsorships can work for small group projects rather than either individuals or projects big enough to have employees and a foundation. Just having money to distribute is a recipe for trouble. And there’s a huge gap between paying people a little pocket money and what they’d need to live on.

Adam mentions oh-my-zsh as being core to him. Robby Russell is at least promoting his Rails business through it. But he’s perhaps handed over much of the work to others more deserving of recognition. First step up the dependency stack would be zsh which, like many old projects written in C, is maintained by a small handful of long-time contributors. And it won’t appear in your homebrew dependency list because macOS includes it. Following heartbleed, openssl got more attention but most things are not security sensitive. The best thing companies could do to help is to find some of these individuals (the random person in Nebraska from xkcd 2347), put them on the payroll and let them work on the project as their job. The industry as a whole can be very ageist and while rare in commercial settings, you can find people that have been involved in a FOSS project for 20+ years.