By exposing your source publically it only requires one person to check to provide herd immunity. It's game theoretically superior to providing source code for one off audits on request.