That's certainty true. I can tell you as an OSS dev that that are simply not enough eyeballs for all bugs to be shallow. However you don't have even the possib

That's certainty true. I can tell you as an OSS dev that that are simply not enough eyeballs for all bugs to be shallow. However you don't have even the possibility with closed-source products. That means you must instead rely on the process used to create the software. So something by MS might actually be pretty trustworthy from a "security issues not accidentally introduced" standpoint at this point after years of improvement on secure coding practices. But they still operate by a profit motive, and there's still the possibility of deliberate introduction of security issues when it suits business purposes or for legal compliance. Unfortunately there's no great way to tell that an OSS project from RANDOM_DEV is well-coded without looking at the code and it may be that a well-intentioned but junior dev introduces a relative swath of security bugs by accident. I don't know where the cutoff is either. It may depend more on your threat model than anything else.