I agree with the open source point (but not that it would solve everything - see "Trusting trust"), but shipping with the backdoor by default is is problematic

I agree with the open source point (but not that it would solve everything - see "Trusting trust"), but shipping with the backdoor by default is is problematic for the attackers, because it makes it public.