Well, I think this is what SchedMD do with Slurm? GPL code. You can sign up to the bug tracker & open an issue, but if you don't have a support contract they close the issue. And only those customers get advanced notice of CVEs etc. I'd expect nearly everyone who uses it in production has a support contract.

I loved that idea & tried prototyping one using two "laser" mice instead of the tape/vision approach but the accuracy wasn't anywhere near good enough

Hah, writing that blogpost from that perspective was a really nice move, I enjoyed reading it!