Some open source projects are different. A lot of them do not cater to end users directly. But if you want to talk about open source security, take a look at how OpenBSD handles issues; they definitely aren't messing around.
If everyone is running the same CPU design but sourced from different manufacturers who had them spun up at different fabs, how would that affect support? Today we have one or two device manufacturers we rely on for support and answers about if security fixes can be done in firmware vs requiring a hardware fix. We can pull the CPU ID of our system and then check with AMD or Intel for an authoritative answer. What does that look like when anyone can manufacture a chip?
Will there still end up being one or two predominant CPU manufactures for desktop/mobile/server CPUs to simplify support? Are we going to have to rely on OEMs to support the CPUs they put in their machines?
I'm fearful we might end up in a situation similar or worse to what we have with Android where smartphones are shipped in their final state and never receive anything beyond failure support from the OEM/ODM.
* Serious question. Apart from the freedom and control aspects of the Open Source model, what is solved with an open source CPU architecture or what are the benefits?
I can see being able to spin your own chips would enable an OEM/ODM to keep producing the same old design indefinitely where as reliance on Intel/AMD/Samsung/Mediatek means you have to refresh your design. That could be both a benefit and a detriment depending on how you look at it.
The freedoms from the Open Source model is substantial enough to make it attractive on that basis alone, just as for Linux/BSD. One example is Western Digital transitioning to RISC-V for their hard drive controllers. I would imagine being able to add your own instructions without having to deal with NDAs and non competes with ARM will be attractive to a lot of OEMs.
Just like with Linux, it's difficult to anticipate what intersting things will come out of RISC-V, but one interesting example is a formally verified RISC-V core, picorv32: https://github.com/cliffordwolf/riscv-formal/tree/master/cor... (presentation here: https://www.youtube.com/watch?v=VU97ffHF_IQ). According to the author, this core will power safety critical applications at a synchrotron: https://theamphour.com/374-an-interview-with-clifford-wolf/
Which means that anyone can implement the instruction set and thus many different implementations can be made. Most likely there will not be one common and shared processor.