Isn’t this actually more likely to happen if it’s closed-source, since the code isn’t visible to third-parties like security researchers? That’s why zero days are a thing.