I just think that invisible hand of the market is an equally virtual limit effect as the many eyes ensemble. The stream of closed-source vulnerabilities is also substantial and a time-to-fix is much larger there, what effectively pays for the additional effort required to identify a flaw.

No free lunch in security rather hides in the trade-off with convenience.