The “million eyes” argument has massive exceptions, among the top of my head is OpenSSL’s HeartBleed, a critical and extremely popular security suite that had a simple overflow issue for a decade or longer.

People don’t read the source. And chief among them, statistically, is you.

Open Source is ideal but not a deal breaker.

True. And yet the possibility exists that one COULD. That's the difference.