The important point is that in the case of OpenSSL, anyone who wanted to know could know, and plenty of people knew. Not the specific vulnerabilities, but the h

The important point is that in the case of OpenSSL, anyone who wanted to know could know, and plenty of people knew. Not the specific vulnerabilities, but the horrible quality of the code base was not just something that you could discover by looking at the source, it is something that plenty of people did discover. Also, obviously, anyone could in principle fix vulnerabilities they find in OpenSSL, without any need to wait for the OpenSSL project or anyone else to do anything.