Closed source centralized SaaS will have a major security advantage.

Edit: Because an RCE in a open-source dependency means you are just as vulnerable when the security patch lands? I don’t see the controversy.