>SEO rigging? That's mostly having links from other reputable sources. If this software is good, other good sites will link to it rising it up in the search results.
This is a myth perpetrated by Google and it's entirely false. The fact is that if you aren't actively engaged in spa--err, SEO--, you will be outgamed and crushed by anyone moderately competent at spa-- err, "internet marketing".
I make a point of replying to this because my established, objectively-superior-in-every-tangible-way company was creamed by a bad copycat that had a pre-existing spam apparatus, despite our one-year head start and, as already stated, every conceivable advantage (we were cheaper, more effective (their stuff basically didn't work at all), and much more attractive (they were using a crappy WordPress template; we had a beautiful custom design created by professional designers)).
I was dumb enough to believe Google's statement that if you're good, you'll gain organic links and your rank will rise. Our SEO strategy was based on writing a lot of blog posts and hoping their relevance and high-quality information would facilitate a rise in the ranks (our competitor had no content at all; just a landing page promoting his bad knockoff product). This strategy had basically no effect. Making good content and/or products and crossing your fingers simply does not work if you have commercial competitors.
>Lots of open source projects come up top of the results when you search for stuff because of this fact.
Technical projects that are either so ubiquitous it wouldn't make any sense for Google to display anything else, so niche that there is no real commercial competition targeting non-technical people, or both. As can be clearly seen with youtube-dl, if it's a keyword that other parties are interested in monetizing, you have to either play the game or lose. The game is not what Google or Matt Cutts say it is (that's disinformation), the game is what actually gets you to a high ranking on Google.