This is a valid question, but the answer is somewhat simple. The open source code is both widely used and easily studied. Because of this, it gets targeted. As

This is a valid question, but the answer is somewhat simple. The open source code is both widely used and easily studied. Because of this, it gets targeted. As it can be studied, the vulnerabilities are both known and talked about. In the case of proprietary software, the owners are neither going to be quick to admit a problem exists, nor quick to allow study of their system(s) to discover the cause (in most cases, exceptions to this obviously exist). Security vulnerabilities are everywhere, but only in widely-used open source code is the discovery of a vulnerability likely to be both known and discussed.