What matters most is the amount of security effort paid to the project, not whether it is open- or closed-source. Commercial decompilers, reverse-engineering to

What matters most is the amount of security effort paid to the project, not whether it is open- or closed-source. Commercial decompilers, reverse-engineering tools and automated bug finders have come a long way - a determined reverser can find bugs in closed-source code almost as easily as in open-source code. But, both kinds of bug finding take time and loads of manual effort (despite good tools), and will often only happen with appropriate incentives. This is where closed-source has a major advantage: companies put up money (in the form of bug bounties) to counteract the bug prices that a researcher could obtain on the black market. This incentivizes "good" researchers to spend time on their products. Open-source projects, even highly-successful ones, rarely have enough funding to run good bug bounty programs. Consequently, good guys can't pay the bills finding bugs in open source, whereas bad guys get huge payoffs for finding and exploiting bugs (think the NSA, criminal groups, malicious states, etc.). As the adage goes, enough eyeballs render all bugs shallow. But, in this day and age, that applies both to open- and to closed-source code.