@marcmerlin As it is at present the FAA does not have enough staff to properly enforce GA regulations and depends on whistleblowers for enforcement actions. Part 107 was a knee jerk reaction to industry pressure from manufacturers and people who want to use UAV's for commercial purposes to "do something". It was not well thought out and is pretty much a joke IMO, giving away a Remote Pilot Certificate to somebody who passes a written test, with no practical exam at all. So the result is that we have commercial UAV pilots that don't have a single clue how to fly, and are depending on software to fly the aircraft for them. To my way of thinking this is akin to getting your instrument rating by shooting an ILS slaved to the autopilot.
Where software is going to get locked down is manufacturers of commercial UAV's who will be named in a lawsuit when a UAV crashes with an unskilled pilot at the controls, that is depending on the software to fly it for him/her - and that software fails. I don't see the FAA getting involved with it and attempting to certify every component, including software, on <55lb UAV's. They simply do not have the manpower to do it.
As many other open-source software projects have proven over time, when you have thousands of eyes all over the world looking at the code for an application, vs only a small team of developers for a closed-source proprietary application, the open-source one always produces a more secure, robust, stable product. Just like the vast majority of the internet prefers to use linux/apache vs IIS, commercial manufacturers of UAV's that choose to use the ArduPilot stack will find themselves in much better hands, with a more robust and stable product than they can build themselves. Even the largest software companies like Microsoft are not able to assemble a developer team that can match the open-source model. There will be a few like DJI that attempt to maintain control of the market with totally proprietary offerings locked down tighter than a drum. And they will eventually shoot themselves in the foot because they shove stuff out the door half-baked and depend on their end-users to find the problems with their products. In the proprietary world that only works until those end-users get tired of paying $3000 for something that doesn't work, and goes thru 5 or 6 revisions before the problem gets fixed.
So I see it as being a non-issue. It will take care of itself.