If this is true how come that the spectre/meltdown discovery came from external vendors? Black box testing is essential in security and majority of the bugs fou

If this is true how come that the spectre/meltdown discovery came from external vendors? Black box testing is essential in security and majority of the bugs found with fuzzers and other black box methods. Just because you have visibility into a product it does not mean that you are going to spot the bugs even less, you won't be able to identify security related bugs. Just to give you a really simple example, flying is one of the safest activities for humans yet all of the airplane producers have "closed" development models. It just proves that safety has nothing to do with open or closed development methods. Another angle, do you have documentation of any bridge you use? I don't think so. Yet, it is extremely safe to use bridges. I think people are trying echo the mantra that opensource is safer and testing is the only way to produce reliable products when we know for fact that other engineering disciplines do not use testing and open development, yet produce much safer to use products.