Yes, opensource doesn't magically fix all vulnerabilities. But it is for sure way better then closed source, where you don't have a way of auditing the code