There's actually three ways, the third one being academia picking up the bill which is how we got the mess that is OpenStack.

Also, Debian has been around for a few decades, although I do admit that - like the Linux kernel - that wouldn't have been possible without a lot of companies contributing back to the ecosystem.