Start asking maintainers for SBOMs (this is rhetorical; please don't) and you'll find out how disinterested they are in doing even more work for others. They understand that there's a problem, but don't have the will to deal with extra work when they're already short on time.

Open source projects tend to be maintained by a tiny number of people who are scratching their own itch, not signing up for more barriers.