That’s a fair statement to say open source on it’s own doesn’t add any security. I will say that any developer who’s intentionally adding vulnerabilities to their code is less likely to publish the source, simply because someone COULD see it. With the number of automated vulnerability scanners on Github, it would require a lot of extra work to go undetected, when simply going closed source is an option. Once again, the more open the better, since there’s fewer places to hide things.