When the tool is opened sourced honest and rogue security experts are going to go through it. Now how much value is the first adding versus the second removing

When the tool is opened sourced honest and rogue security experts are going to go through it. Now how much value is the first adding versus the second removing is the case. And based on incentives for each, an honest security research maybe getting a small bug bounty, and a rogue one potentially gaining access to 10's of thousands of accounts I think it might be a net negative overall.