Perhaps – but it's certainly the case that if one wanted to find an exploit, it would likely be easier with the source code in hand. Now, this isn't an argumen

Perhaps – but it's certainly the case that if one wanted to find an exploit, it would likely be easier with the source code in hand. Now, this isn't an argument against open-source software – much to the contrary, in fact, because, I'd argue, OSS has, by virtue of being developed in the open, had much more opportunity for bugs to be seen by contributors and by those looking to crack/exploit it. As exploits are found, they get patched. Closed source, code, on the other hand, faces a lot of catch-up when its code is released into the wild. I'd argue that's a bit like what happens to one's immune system if it's not regularly challenged (particularly as a child). Frequent exposure to pathogens tends to make one's immune system better, whereas living in a bubble only works as long as nobody lets you out. Also, as much as codebases change, many parts stay the same, so yes, 5 year old code may well still be similar to currently shipping code that unexploited/unpatched issues may well still exist.