Why are so many small and medium sized open source projects falling for the OpenCollective (third party) scam?