It's not all or nothing. Open source is better than close source for security auditing purposes, but of course open source alone is not enough, nor is it impervious to security flaws. It's just better than the alternative.