I work in a open source software and I can tell you for sure that this only works in theory, at least for projects that aren’t giant like chromium. If I push some code to a new branch on github there will be people looking at the changes before I even had time to open a PR, but very obvious security flaws can stay in the code for several years before anyone reports it. The amount of people looking for things to exploit is just much larger than the white hats. Sure they could still find the same flaws without access to the source, but we’re making if easier for them.

Tbf as long as it doesn’t go public it will probably be fine regardless of who takes the job. It doesn’t take a genius to keep up the good work in a company that can afford to plan long time.

Last one can be freely changed by anyone, the middle one still has some restraints.