I used to be paid for a decade to work on open source software - by my employer.
We always upstreamed fixes. This is the only way.
Filing bugs, etc, is also has some value, but if a big company uses a piece of open source software and makes money with it (even indirectly), they can contribute engineering time (or money).