High compliance costs are more favorable to well-resourced large companies and may have an asymmetric impact on the open-source ecosystem.