And how much of that is already using open-source and it's the configuration that's leaky, and not the software itself?

How many poorly maintained/updated/configured Linux hosts are out there? Same for Windows, etc... in the end, the software can be the greatest, but if the host's configuration is poorly setup/managed, what does it matter.