> without having to invest in catering to the four total users who will want to build a system image

They have to release that code anyway. All they have to “invest” in is not implementing measures to prevent people using it.