To address the title: It does not happen in practice, and the idea that "simply because code is open-source and viewable, it is more secure" needs to die. It is

To address the title: It does not happen in practice, and the idea that "simply because code is open-source and viewable, it is more secure" needs to die. It is an open-source fantasy, like Linux on the Desktop. Code becomes secure when you train your developers, when specialists audit your code, and when you consciously choose safe libraries and frameworks to build upon. Tasks like these all cost time and money and organizations that spend on security are ones with "skin in the game" who can afford to pay for it.