Make it clear great OSS doesn't always meet criteria (#972)

It's great when OSS meets all of these, but we don't want
people to think that only OSS that perfectly meets all
these criteria could be used.

Signed-off-by: David A. Wheeler <[email protected]>

Author: david-a-wheeler

docs/Concise-Guide-for-Evaluating-Open-Source-Software.md

@@ -2,7 +2,7 @@
 
 _by the [Open Source Security Foundation (OpenSSF)](https://openssf.org) [Best Practices Working Group](https://best.openssf.org/), 2025-03-28_
 
-As a software developer, before using open source software (OSS) dependencies or tools, identify candidates and evaluate the leading ones against your needs. To evaluate a potential OSS dependency for security and sustainability, consider these questions (all tools or services listed are merely examples):
+As a software developer, before using open source software (OSS) dependencies or tools, identify candidates and evaluate the leading ones against your needs. To evaluate a potential OSS dependency for security and sustainability, consider these questions (all tools or services listed are merely examples, and even great OSS may do poorly on some questions):
 
 ## Initial Assessment