The problem is less about openness itself and more about quality of auditing. Open isn't a magic bullet. As I understand, these latest CPU vulnerabilities were in the spec themselves. You could've found them by reading the manual. See what good that did us.
But I posit that open projects do better with audits than closed because they are more likely to have open audits as well, and an open audit is harder to ignore or sweep under the rug if it's inconvenient to business.
But I posit that open projects do better with audits than closed because they are more likely to have open audits as well, and an open audit is harder to ignore or sweep under the rug if it's inconvenient to business.