And with OSS we can see when the create back doors or modify the code. We can see what the modifications do. And if they are doing anything wrong we can revert the changes and publicise it. Following on from your thinking, what is their angle here? On the surface it seems more difficult to exploit OSS but is there something they can do with it that users won't know about and is easier to exploit?
Subtle security leaks are not in the center of the all-bugs-are-shallow theory. Cryptographically insecure communications don't cause code to throw exceptions or systems to crash. The effects are social. Unless Eve tells Alice or Bob, neither will know she's read their communications.
