No, you don't. Some open source producers might choose to take on that extra burden, but giving your software away for free cannot automatically create such a burden, no matter how many people use it. The only recourse you have as a user if you don't like that deal is to not use the software. You don't have the right to demand more free work from someone who already provided you with free work.
I mean usually you have to promote software and by promoting you create an obligation - no one is going to use it if you drop some piece of code on GH and in reader you will write „I don’t care about it take it or leave it”.
You have to actively promote and show that you care to create „widely used software”. Promoting by showing that you care creates the obligation. Of course obligation is not entitling people to tell you what to do - but to keep level of decency like fixing glaring security flaws.
Second, even where a developer puts some legwork into letting the world know what they've shared, that effort is within the context of the project's license terms which almost universally make it explicit and clear that they profer no such obligation.
Tweeting "I made this thing, check it out!" does not soemhow absolve the user from reading the license on that thing and understanding that no promises are made.
It is then the same as Microsoft/Google or any other for profit company - you also get "software as is" and even if Excel blows up all your data MSFT is not liable for it. But still there is expectation that they will fix bugs that blow up someones data.
The thing is I pay for for Excel so I expect and demand them to fix their bugs! If I use an open source library for free I have no right to demand them anything, I can hope they will fix their bugs, I can contribute and fix the bugs myself if I can, but I have no right to the developers time or attention.
Promoting by promising to fulfill a particular obligation creates the obligation. I'm not sure "showing that you care" is specific enough.
In any case, you are shifting your ground. Before you said that just making the software available and having enough people use it creates an obligation. Now you are saying that "promoting" it does. When "promoting" is properly unpacked, you will end up agreeing with my position: either the software author has made an explicit promise to provide support, or they haven't. If they have, they have an obligation; if not, they don't.