I think webkik is saying, Open Source is better because if you DO spend money on security it can be spent by the community in aggregate / across successive efforts to pay experts to AUDIT the open source project.