Open source maintainers underpaid, swamped by security, and going gray