> Audits can be hit and miss,

The same could be said for proprietary applications, which may never see third party audits because 'meh, customers have no access to our source and IP protection or something'