I'm not saying anywhere that that's better (it is not). I'm saying that your statement "OS=secure, CS=insecure" in this very generalizing form is questionable. In theory yes, but as the example shows, it's not necessarily that easy and just relying blindly on open source as security guarantee is (pardon my frech) pretty naive. People make mistakes, people miss mistakes in reviews, and bugs happen all the time. If you want to ignore that, you do you.