This is a link to a ccc talk about why open source projects need more funding:

10 Mio€ für Open Source - jedes Jahr Translation in more than German language would be needed ;-)

It suggests 5% support for each project done in firms, which do use a lot open source code.

Log4j clearly showed how expansive not doing the upfront work could get ;-) and how open source from big to small players suffers a lot even though one would think they are "well" funded.