I agree. I would argue that Microsoft have the worst of all worlds because on the one hand they share their code with intelligence agencies (including the FSB!) who seem to me to be inclined towards hoarding vulnerabilities for attack rather than getting them fixed upstream. On the other hand, much of their code has been leaked illegally; which makes it available to any and all black hat hackers but many law-abiding white hats will be constrained in their possible use of it. So everyone has the code except for the people who might report bugs/ fixes.