It was a bit of a strawman question anyway; as someone who could review the source myself but wont (because the pain-to-utility threshold is way too high) I am then required to place my trust in some ad-hoc entity (the open-source community), that doesn't actually have a financial disincentive to make sure things aren't bad.

I have other reasons, perhaps, to prefer open source stuff, but I am not ready to assume it is inherently more private or secure.