Sure, but they're also being defended constantly by armies of programmers. When a vulnerability is discovered, the four projects you mentioned are all awfully quick to issue and distribute patches.

Think about how Google pressured Microsoft to fix a vulnerability when MS was too slow to respond[1]. That's the kind of crap you see with proprietary development.

Open source is just a flat-out better method of developing software, but especially so when it comes to patching vulnerabilities.

[1] https://www.engadget.com/2015/01/02/google-posts-unpatched-m...