Metamask (most popular eth hot wallet) unfortunately is proprietary too nowadays (some commercial restrictions) [1] but at least you can build it yourself, all commits are visible and it's developed in a semi open way.
To me big potential issue about Metamask is if a compromised update got pushed out; a lot of damage could be done before people noticed even if it would be discovered immediately.