That may be true for popular projects with allot of contributers, but for small projects, being closed source in the age of LLMs is not a bad idea especially for server side code, it can be more secure simply because the bots don't have access to your code and can't do analysis on it.