I also work for MSFT, and this story is frankly embarrassing. It's not even this particular case, it's that this is a pattern, both Microsoft-wide and industry-wide. The initiative you describe is part of the problem - it wouldn't even be relevant in this situation if we as a company properly funded the dependencies that we use. As you say, Microsoft has lots of procedures and bureaucracies, yet we have streamlined the use of F/OSS significantly compared to 12 years ago (I know; I was there when you had to have multiple meetings with lawyers every time you pulled in an open source dependency). Why didn't we do the same for supporting those dependencies? Why is it not part of the same workflow, even? Surely if something is a critical component in a shipping product, it needs to be sponsored appropriately automatically?