This had nothing to do with code vulnerabilities let alone open-source in general. It was a social engineering hack relying on default voicemail passwords.