Oh, absolutely, that's true. Definitely smaller projects have less audited code, and even bigger projects can have bugs. Heart bleed ring a bell, LOL. However, when open source software has a bug and it is discovered, it is fixed by somebody in record time, whereas in closed source software, you don't know that there is a bug that can be exploited and it definitely won't be fixed until it's reverse engineered or something or exploited.