When talking with the security folks I know, this is not a rare opinion. You can't trust the source of any comms platform. So you have to reverse engineer the binaries. Once you get into that game the more important things than open source are, do you trust the team? Is the protocol open and vetted? Does it rely on 'odd' implementation details.
The idea that the nature of the software license of the OS that your comms platform is running on, is important for its security characteristics, does not seem to be something that the experts I know believe. Quite the opposite. It seems to be a signal of people who don't do this sort of research for a living.