No its not. There's plenty of open source project that have excellent security track records where no one gets paid. Also, paying gavin does not make this project more secure, it makes it LESS secure, because it creates dependencies, centralization and it gives influence through a small amount of companies that have a financial interest for themselves rather than towards the community.