Surely this depends on the system being run and the programs running on it. Are you claiming that a basic installation of OpenBSD is wide open to the NSA? Even if that is true, I would think that fewer vulnerabilities are better than more, and that vulnerabilities that cannot be found because their source is secret are worse than those that can be found.