

Only reasons I can think of are time and money. We sadly lost DivestOS and their projects… How about software patents, which of course are bullshit; but even illegitimate threats can ruin small businesses and lone programmers who don’t have the time and money to defend themselves.
The “vulnerability” was only that F-Droid wasn’t keeping up with their builds, leaving everyone who installed it from F-Droid out-of-date, during a period of known Firefox bugs being exploited.