Look at the lists of CVEs that come out every month for closed source software. How did they fix them?

You don’t know. I can tell you that that my colleagues have found cases where major vendors don’t “fix” a defect - they prevent the public exploit from executing. With open source, you can see exactly what was fixed and how.

You don’t lower or raise security.