If the smart plan of having others reverse-engineer the fixes won't work, I imagine they'll turn into a delayed-source product.

To my recollection, they always maintained that being open-source doesn't matter for security, after all

(I strongly disagree)