Yup completely valid. In the context of the original post I was replying to, trust of the closed source client code was always required and that hasn't changed,

Yup completely valid. In the context of the original post I was replying to, trust of the closed source client code was always required and that hasn't changed, so it didn't feel relevant to mention. I agree with you that there is significant merit in choosing an open source solution for passwords/secrets management.