in security where breaches can cost a lot of money, relying on heavy use as an indication of trustworthiness may not be a great idea.

For example OpenSSL was and is used by lots of people, this has not stopped it having a lot of security problems...

And true once the vulnerabilities get published you get to know about the problems more quickly but then in a world of targeted attacks and professional exploitation that might not be great comfort..