Putting aside the idea that everyone can read the code and find/fix exploits, sometimes it's good to be open to vulnerabilities because you know where/what to fix.

Sometimes closed code it's exploited for years before the owner or general public finds out, and that leads to more problems.