OSS is a double edged sword. It’s great, but the people looking for flaws that are exploitable are more often bad actors than good. At least that’s been my experience working in cyber security. Many CVEs that are responsibly disclosed are found to be actively exploited already.