Yeah, this pretty much. Big companies like Google, Amazon, Microsoft, Redhat etc. depend on Linux distros and open source software like xz to make large sums of money. But they are too cheap to fund these projects and prevent security fiascos like this.

Just like with openssl, where they didn't bother investing until months after HeartBleed.