Wasn't there a post here about how little review open source software actually gets due to the highly specific knowledge required to identify vulnerabilities?

Wasn't there a post here about how little review open source software actually gets due to the highly specific knowledge required to identify vulnerabilities? something like: https://www.itworld.com/article/2922074/significant-virtual-machine-vulnerability-has-been-hiding-in-floppy-disk-code-for-11-years.html https://www.itworld.com/article/2922074/significant-virtual-... Seems like creating a foundational open source project and introducing a few key bugs would be the best way to hide in the open.