Unfortunately, and to a large extent why people listen to "open source advocates", the community of security professionals has a surprisingly bad record when it come to things like risk analysis, legal matters, understanding how law enforcement or intelligence agencies work and other ”soft skills”. I trust security professionals when it comes to crypto. Anything else I'm not convinced they aren’t as incompetent as everyone else in software and maybe even more so.