In my opinion it is a terrible choice for a company to rely on a dependency like XZ, especially maintained by one person as a hobby, without being able to meaningfully contribute to the maintenance themselves. I just don’t think I can be sympathetic to a company having to maybe bend a rule or two to donate.