Too bad that the focus is open source. This is a common ailment seen in many security research papers!

A real concern should be Code-Level Backdoors in COTS software. Backdoors that even many resellers and paying customers are not aware off..