Most, if not all, closed source software builds on open source software at this point, if not directly then at least in the tooling around the development proce

Most, if not all, closed source software builds on open source software at this point, if not directly then at least in the tooling around the development process (compilers/interpreters, version control, build systems, etc.). I doubt that most developers of closed source software have audited their entire tech stack. So in the end you have all the same problems with proprietary software as you describe for foss, but you don't even have the opportunity to audit the source code yourself, should you want to.