But such flaws could exist yet we would never possibly never find out - although with a large company which is supposed to have sophisticated error-checking you would hope that would never happen.

I do see the argument that there can be a stronger vetting program in a project rather than a full "anyone can commit" method. For example, Drupal has a lot of people developing it, but very few people who have commit access to the project. This seems to ensure that the code has both the advantages of open source development but also with a good vetting method.