> If there is a commonly used open source library without hackable bugs, you won't even hear about the author who committed his/her own time to build reliable software.

Come on, that's not true. There was a sectest made on dovecot a while back, and it came out to be a really well written piece of software, and everybody complimented the authors and had kind words for them. Same for ssh and a lot of other oss.