Quite the opposite. If you give a product for free you cannot be fined for it, obviously.

Yet, open source can be vetted, and people can be paid to review and vet software.

Debian developers review software before uploading it end often do additional work on hardening it.

The distribution then freezes to ensure maturity, let people discover vulnerabilities and backport fixes.

https://www.cip-project.org/ builds from Debian and goes even further by supporting releases for decades.