Security audits, good implementation and proper reserach require the work of rare (as in there aren't many) and talented individuals. The funding model for open-source security is bug hunting and having big corporation who use your open-source product to give you from their money or their talent.

A funding model where you pay the company to hire auditors, implementors and researchers directly could be argued to be the better funding model.

I'm not saying it is better, since open-source has proven itself many times, but it has also failed miserably many times because of lack of funding or interest.

Open source, especially open-source that is produced and maintained by companies with different agendas (for instance google) as opposed to a foundation is prone to having that agenda color the way it works. Commercial product's agenda usually align better with it's customers then some random company. Some would say that in a security product it is vitally important that the creators' motivations are aligned with the users'.