A counterpoint to this is the billion dollar success of cryptocurrencies such as IOTA and Verge that are fundamentally broken from a cryptographic point of view.

But they have been called out many times

But dumb money is dumb. Masses of people are seduced by marketing and internet forums.

Real world open crypto libraries have sometimes really atrocious code. Openssl being notorious.

Open source is way to go imo, but the automatic assumption that it is good or someone reviewed it is wrong.

> or someone reviewed it

Sometimes I wonder if everyone assumes everyone else has reviewed it, therefore nobody has reviewed it

It is awful lot of hard work and requires a lot of special knowledge not that many have. Plus it is guaranteed political fight afterwards.

Average programmer don't know what to look for and can't do it over wekend.

I covered this in an essay about security of various models of source sharing. It came down to talent and methods of developers and reviewers being what determines trustworthiness of a specific project/product. Although my stuff is text (old school), roryokane on Lobste.rs kindly made a better-formated, HTML version here:

https://gist.github.com/roryokane/d02addfa9329c579f15daef5b4...

EDIT: This also answers another commenter's question about when I'd trust closed-source software. Essentially if I trust the developer and/or reviewer. Then, I have to know I'm using the same thing. So, they have to publish signed hashes and so on of either the binary or source.