They probably added "open source" to indicate that they are not at fault, which is understandable. However, they could have stated "bug in a third-party library" instead. By emphasizing that it was Open Source at fault, they perpetuate the "You get what you pay for" anti-open source rhetoric that was prevalent a some years ago.