Browsing and understanding the source (and even the release notes, and bug trackers) of open source projects is frequently time-consuming, technical, and inaccessible. Particularly when it's ensconced solely in a GIT or SVN repo, with no user-friendly web front-end, and is only accessible via a command line.
I disagree with "robin_reala".
Updating software at your leisure, ON YOUR OWN SCHEDULE AND NOT SOMEONE ELSE's, by downloading installers, patches and packages is often a pretty reasonable task. Especially when it's a browser like Firefox or Chrome. It's also better to have redistributable offline copies of installed software and updates that you can retain as backups (uninfected backups, of course), in the event that network connectivity is unavailable, or because the network was essentially the source of the infection in the first place.
Yeah, yeah, yeah... good security practices dictate that we are ALWAYS on someone else's schedule. Live in fear. Okay, yeah, that's great, I get it, we all get it.