Sorry what? 99.999999% of all the malware that exists and has existed today, is/was closed source. Compare that to the other 0.0000001% that got once or twice into opensource and was removed as soon as it got detected.
> The main ones are 1. untrusted users being hosted 2. javascript off the web.
I've never talked about (1), of course my comment was not targetted to server owners but by normal workstation owners that only have one user. WRT 2: that's precisely why I mentioned NoScript. Nowadays the only untrusted software that could be run in your computer if you were using opensource OS and opensource apps exclusively is javascript from the web (which is by default closed source).
There is plenty of open-source malware, and most closed source software is not malware.
You seem to be conflating "is in a trusted open source distribution, listed as non-malware" with mere "open source". Code that is openly malicious, or has never been peer-reviewed, is still perfectly capable of being open source.
> I've never talked about (1), of course my comment was not targetted to server owners but by normal workstation owners that only have one user.
That's cool but the workstation use case is not why people are freaking out. The workstation is the place where you don't even need this bug to take over and ruin everything, because it's all under one account anyway.
Saying it's a "way to not be affected by these bugs" is pretty myopic.
So is closed source software.
You seem to be deeply confused about the scenarios people are worried about.
The main ones are 1. untrusted users being hosted 2. javascript off the web.
All the open source in the world doesn't help in either scenario.
You're focused on someone deliberately running a malicious program. But if they do that, these exploits aren't even necessary to do severe harm. It's a marginal scenario at best.