The fact that a single person couldn't possibly fully understand a complex system is all the more reason to get more eyes on it. Besides, security is not the sa

The fact that a single person couldn't possibly fully understand a complex system is all the more reason to get more eyes on it. Besides, security is not the same as privacy, There's a huge difference between spotting where a network connection is being created, what data is sent and where to vs completely understanding an entire code base and spotting cleverly obfuscated code or low level bugs. With closed source, only employees get to see the code, their goals align with the company. Open source, anyone can see it and raise stink about things they don't like on behalf of all users. It only takes 1 person for all users to get the benefits. Granted, open source doesn't prevent all privacy issues, MS still does telemetry in OSS projects, sometimes not even allowing to opt-out, and they just ignore the countless complaints, and enough people still use it. Such is the state of the world I guess. But imagine one day MS decides to say they're no longer collecting telemetry but they've actually put in some cleaver code that looks like it does one thing but actually sends telemetry data. Getting caught doing that would be a way bigger PR issue that would, hopefully, cause far more users to completely stop trusting them, even if all their code was open source. I don't expect companies that want to stay in business for long would attempt such a thing.