Only accepting bugs with a fix is not a solution. Because who is going to vet the patches? Are you going to accept a Chinese patch for some obscure security issue? This is how real security problems are introduced.
You really should check out much much code in e.g. the Linux kernel is written outside of "the West". It's not the 90s anymore.