Or just employ people to contribute to some of the many popular upstream projects to slip in a vulnerability or two. Edit: not to discredit Linux of FLOSS, at

Or just employ people to contribute to some of the many popular upstream projects to slip in a vulnerability or two. Edit: not to discredit Linux of FLOSS, at least there is the possibility to analyse the source code.