Comment by verbify

There have been bugs in open source cryptography. E.G. Heartbleed, shellshock, etc.

There are state actors that will pay to find the bugs, or put the bugs there (and the underhand C contest shows how hard it is to find the bugs).

Open source is not an ironclad guarantee.