I think there's a problem with this reasoning, which is that it may be that these bugs are discovered now only because they are open source, and many more such

I think there's a problem with this reasoning, which is that it may be that these bugs are discovered now only because they are open source, and many more such deep bugs exist in closed-source software. The flip side of the boon that is code reusability is software monoculture, which means that a significant bug in a core library can have catastrophic effects in many systems, so it's likely that the most severe bugs are rarest (hardest to observe), but the longer they go undiscovered, the more catastrophic they will be. It may be that while we'll find some deep, 20-year-old flaws in core open source code, we'll find way more 20-year-old flaws in closed source code, except we'll find them in 5 years, after the Internet of Things has taken off and a serious bug will be 100x more dangerous.