> Does that mean we can not impose any expectations regarding security on its maintainers either?

Yes. If you want a secure version of Linux, pay a vendor like Red Hat who’s willing to provide those assurances.