As long as you some assume that there are no unpublished exploits in Linux. The Heartbleed bug was in open source code for a year and a half before it was found.