They are not exactly wrong with the first point, actually. I once worked on a DARPA malicious code detection challenge and even carefully inspecting the source

They are not exactly wrong with the first point, actually. I once worked on a DARPA malicious code detection challenge and even carefully inspecting the source of a library can often fail to uncover a carefully crafted implant, even if you know there is going to be something there and even if you know it is hidden within a small area of 5-50K lines of code. Of course, they are right whether the code is open source or commercially developed (how many companies have counter-intelligence divisions to vet or monitor their employees to detect proper spies?). For something critical enough, you would want all the code to be developed in-house using some semi-formal process (or, if truly truly critical, formal verification), but it probably depends what the project is. Of course, if it is in python, then it seems to me the horse is so far out of that particular barn door that it is now half-way across the country...