In an ideal world, whether code is open source is neutral. The extra ease of finding bugs is balanced by the fact that people can and do find then fix them. Theory says that these two are, to first order, equivalent. So end user security is the same. (But code quality tends to be higher with open source software.)

However whenever code moves towards being more open, you've got all of the vulnerabilities of closed source software, and all of the bug-finding ease of open source software. This is the worst of all possible worlds.

Therefore #5 is true. The fact that you have easy access to known-to-be-crappy code increases the vulnerability of that code.