I mean he’s legally obligated to, not really a choice. He can say screw it, but then he opens himself up to legal troubles. Also hasn’t there been instances of state actors trying to slip in vulnerabilities to Linux as anonymous devs?