a single dev taking out multiple programs isn’t exactly wrong

It’s also not unique to F/OSS. This could well happen in a business, and often does.

Has anyone seen a solution for that?

Short answer, anything that does dependency tracking and pinning. If a new release of a library comes out, you shouldn’t just upgrade to it without testing.

On a desktop Linux OS, I would expect the distro maintainers to do that testing before it gets pushed to their repos (as an example).