It cuts both ways… Closed source things can be hiding shit… or simply never testing/caring about it… Oftentimes a truly interested person can externally test it and find the flaw anyway… but not always.

Where open source can have a lot of people who care about it… but never have the manpower to fix it.

The best open source projects are the one that have closed source backing it seems. I’ve had my company throw in resources into open source projects before because we used them.

But jellyfin and the likes would be hard to get backing for