On the other side: No. When you provide software that is widely used and that people rely on, you automatically created a community where fixing bugs is an obligation. Your software has become a corner stone in other people’s software stack/life and so those people and their issues with your software have become your problem, too. If you want it or not.
Hiding behind open source and not fixing bugs has become a deal breaker so many times over the last few decades, that I stopped counting. Not everybody knows the language needed to fix a bug and not everybody understands the dependencies within a project to being able to fix a bug. So “fixing” one bug can create ten new ones and make things much worse.
Not to mention what happens when you attempt to fix the bug but the source is not accepted upstream because it’s bad, which is understandable, but still leaves you with an upstream version of the software and your patched version that fixes said bug.
No, you don't. Some open source producers might choose to take on that extra burden, but giving your software away for free cannot automatically create such a burden, no matter how many people use it. The only recourse you have as a user if you don't like that deal is to not use the software. You don't have the right to demand more free work from someone who already provided you with free work.
I mean usually you have to promote software and by promoting you create an obligation - no one is going to use it if you drop some piece of code on GH and in reader you will write „I don’t care about it take it or leave it”.
You have to actively promote and show that you care to create „widely used software”. Promoting by showing that you care creates the obligation. Of course obligation is not entitling people to tell you what to do - but to keep level of decency like fixing glaring security flaws.
Promoting by promising to fulfill a particular obligation creates the obligation. I'm not sure "showing that you care" is specific enough.
In any case, you are shifting your ground. Before you said that just making the software available and having enough people use it creates an obligation. Now you are saying that "promoting" it does. When "promoting" is properly unpacked, you will end up agreeing with my position: either the software author has made an explicit promise to provide support, or they haven't. If they have, they have an obligation; if not, they don't.