It all starts out with people who make stuff for free, and sometimes they receive donations. There are also non-profit grants that can fund a few months here or there. Money is pooled in organisations, and those organisations pay out project members.
Most of Linux development is done by companies like Red Hat, Intel, AMD, Canonical, you name it. Plenty of volunteers, but not enough to make projects like these. There are also projects by big companies like Twitter and Facebook that get open sourced because it’ll get them goodwill and free patches from the community. Facebook is developing React regardless of its license so they may as well share it.
Smaller projects are just hobby projects most of the time. It’s “free” as in “mattress”, in that you should think twice before adding it, and don’t even think you’re entitled to help or free work.
Sometimes that goes wrong, like when left-pad got pulled, or when colors.jb pushed an update in protest, and billion dollar companies could suddenly no longer update their software because they used the free stuff Some Guy put out in their critical build chain. Or, as xkcd accuratelt depicted it: xkcd.com/2347/