Putting aside the idea that everyone can read the code and find/fix exploits, sometimes it’s good to be open to vulnerabilities because you know where/what to fix.
Sometimes closed code it’s exploited for years before the owner or general public finds out, and that leads to more problems.
Heh, I’m looking at you to those people that looked at me weird because I told them I was good with Keepass!