I don't have an actual answer, but I strongly suspect that the compensation of library authors is going to somehow be tied to supply chain assurance. At some point it will be considered irresponsible (perhaps to the point of liability) to ship software containing FLOSS libraries without paying somebody to do a minimal audit that the version shipped has not been hijacked by malware. The only question in my mind is whether any of that money will flow to actual creators, or whether it will just sustain a self-licking ice cream cone.