None of what I'm saying is unique to the mechanics of open source. It's just that the open source ecosystem as it currently exists today has different attack surfaces than a closed source ecosystem.

Governance models for a project are a very reasonable thing to consider when deciding whether to use a dependency for your application or library.

At a certain point, though, that's outsourced to trust whoever someone else trusts. When I trust a specific distro (because I'm certainly not rolling my own distro), I'm trusting how they maintain their repos, as well as which packages they include by default. Then, each of those packages has dependencies, which in turn have dependencies. The nature of this kind of trust is that we select people one or two levels deep, and assume that they have vetted the dependencies another one or two levels, all the way down. XZ did something malicious with systemd, which opened a vulnerability in sshd, as compiled for certain distros.

You're assuming that 100% of the source code used in a closed source project was developed by that company and according to the company's governance model, which you assume is a good one.

Not at all. I'm very aware that some prior hacks by very sophisticated, probably state sponsored attackers have abused the chain of trust in proprietary software dependencies. Stuxnet relied on stolen private keys trusted by Windows for signing hardware drivers. The Solarwinds hack relied on compromising plugins trusted by Microsoft 365.

But my broader point is that there are simply more independent actors in the open source ecosystem. If a vulnerability takes the form of the weakest link, where compromising any one of the many independent links is enough to gain access, that broadly distributed ecosystem is more vulnerable. If a vulnerability requires chaining different things together so that multiple parts of the ecosystem are compromised, then distributing decisionmaking makes the ecosystem more robust. That's the tradeoff I'm describing, and making things spread too thin introduces the type of vulnerability that I'm describing.