Free software accomplishes more with less. However, there's now too much code, too few competent eyes, and all those eyes are forced to make a living optimizing stupid shit like advertising display algorithms. If the companies that built their fortunes on all the free software that made their empires possible dedicated a tiny fraction of their fortunes to making sure the software gets maintained well, there wouldn't be an issue.
Instead, however, they refuse to contribute because it is also giving their competitors an edge. Such is the tragedy of the commons.
The takeaway from all this, to me, is simply to acknowledge that while "with enough eyeballs all bugs are shallow" may or may not be true, there's no easy way to know, a priori, how many eyeballs are "enough" - and Open Source projects (right alongside ALL software projects) should still utilize tools like static code analysis, fuzzing tools, should still have dedicated security audits from time to time, etc.
The other takeway is that "defense in depth" is still mantra number one for security. You can have a hole at any level, which means that every level must work to limit access to the greatest possible extent. A hope and prayer and expecting all software to be bug-free isn't going to cut it.