Sure, something might fly under the radar for a while, but once there's an accusation of impropriety or a security hole discovered, anyone can look into it.
Open source brings transparency when the publisher is not a malicious party, but a flawed basically legitimate actor that doesn't have reason to risk the reputation hit of hidden backdoors.
People can then look at what the code does instead of relying on corporate spin.
Sure its more visible than closed source, no question, but still it's no angel.
Apple is no angel either but at least they do not pretend to be ;)