You're using "open" in different contexts, one applying to a platform (e.g. blockchain or facebook app api) and another in regards to access control.

As platforms, blockchain is more open than facebook and for access control it's less open. GP was referring to security being at odds with openness in the sense of access control.