No, they can't. Paying for all code by paying employees or paying third parties is still paying for all code. That's not feasible. The EU regulators are simply nuts.
>>crypto+(OP)
The hypothetical company that warranties log4js is selling many of those contracts, but only doing the authentication work once for each release.