Fortunately as we saw from the OpenSSL debacle a while back, often deep corporate pockets (like Google) will step up and audit/patch these projects. Being open is obviously a pre-requisite for that to happen.