Putting aside the idea that everyone can read the code and find/fix exploits, sometimes it’s good to be open to vulnerabilities because you know where/what to fix.
Sometimes closed code it’s exploited for years before the owner or general public finds out, and that leads to more problems.
ahem