Unfortunately can audit and do audit are very different things. I'd agree absolutely FOSS has a higher possible level of trust than a proprietary solution, how

Unfortunately can audit and do audit are very different things. I'd agree absolutely FOSS has a higher possible level of trust than a proprietary solution, however in practice I don't think it's necessarily the case. To take one example with a propietary solution with code from a single company, it is possible for a level of background checking to be done on all contributors. With a FOSS solution, that's just not possible, so you get risks like what if one of the contributors is being paid by a nation state who would like to place a specific bug/vulnerability into a codebase. Of course in practice the world is much muddier than that as pretty much all propietary software vendors make ample use of code they did not write, and in many cases on open source code that they don't really controle the provenance of. Personally I'd say the idea of having a high level of trust in any larg'ish software stack is very dubious these days given the likely incentives of various groups to compromise them.