Researchers associated with UMN intentionally submitted patches to the Linux kernel with vulnerabilities in them as an experiment. OSS maintainers shouldn't have to be the unwitting test subjects of experiments and have their time wasted (or worse, have vulnerabilities make it into their source code) so that researchers can write a paper about it.
So... basically the entire internet, then?