and not to mention the nasty Heartbleed that's still affecting us.

Open source only means the code at some "point" may have been vetted and secured but it will not remain secure forever.

At this point, there is no secure anything, as long as it is man-made, it can be broken by another man.

Apple has incentives to protect your data and it has enough money to not have to rely on sharing the data unlike Google and other Android companies. But this is not to say Apple isn't evil. They all are by default as in the nature of for-profit business they're in.

And besides, open source doesn't mean anyone has reviewed the code. Reviewing a program for security takes work, regardless of whether it is open or closed.