There was always, in my mind at least, a tension with Linus's Law ("given enough eyeballs, all bugs are shallow").

It's true but the problem is assuming, just because something is open source, it has received sufficient eyeballs. AI now gives us near unlimited eyeballs so, if we survive the bumpy transition, open source should indeed become very secure compared to closed source.