That is very true; many incorrectly think that open-source alone brings some privacy guarantees, while it might bring some security ones.