True, but you have a bigger user base and if there's any document exfiltration or compromise, it's more likely other people will notice too.

Yes, with open source you can look at the source, but who analyses the whole codebase before compiling anything?