"Free" software still has to pay people.

• Support and subscriptions — sell certified builds, long-term support, and SLAs. (Red Hat.)
• Open core — the core product is open source; enterprise features are proprietary. (GitLab CE/EE.)
• Hosted / SaaS — run it for people who don't want to. (The model that triggered the license wars.)
• Dual licensing — GPL for everyone, a commercial license for those who can't comply. (Qt, historically MySQL.)
• Consulting, training, and certification.
• Sponsorships and donations — GitHub Sponsors, Open Collective, Liberapay, Thanks.dev.
• Grants and funds — Sovereign Tech Agency (Germany), NLnet, Alpha-Omega, foundation grants.
• Employment — most significant open source code is written by people paid by companies that depend on it.

The underlying problem is captured by xkcd 2347: modern digital infrastructure resting on "a project some random person in Nebraska has been thanklessly maintaining since 2003." Heartbleed, Log4Shell, and xz were all that comic happening for real.