Would it be any better if this library was a proprietary product, the vulnerability would have been discovered by NSA and exploited until the end of time?

Come to think of it, they wouldn't even have to search for any exploits. Just ask devs nicely to put the backdoor in and be done with it.