in security where breaches can cost a lot of money, relying on heavy use as an indication of trustworthiness may not be a great idea. For example OpenSSL was a

in security where breaches can cost a lot of money, relying on heavy use as an indication of trustworthiness may not be a great idea. For example OpenSSL was and is used by lots of people, this has not stopped it having a lot of security problems... And true once the vulnerabilities get published you get to know about the problems more quickly but then in a world of targeted attacks and professional exploitation that might not be great comfort..