> If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens.

I have spent a lot of time in public sector IT and I’ve rarely seen a management or information security team that didn't subscribe to this kind of security through obscurity thinking for internal code, including the management teams that were completely behind using open source code for cost, robustness, and avoiding vendor risk.