In any real security environment, humans are poison. Period, end of story. This is not an issue exclusive to open-source.