OPSEC for developers is a much harder problem I would argue. There is an inherent tension between developing for open source + having your project get attention, while existing in a non-permissive environment.

I think your ultimate barrier to innovation is the current political overton window.

The more innovative, the higher OPSEC required, and the slower progress will be.

Everything in it's right time.