True enough, best outcome would be some security resarchers get hold of the code & responsibly disclose such holes, though once the code is in the wild, the bad guys tend to act faster than the researchers, knowing they're in a race.
At least if holes are found they'll get patched, once the fuss dies down it ends up better for it.