Yes, but you have less people that can look at such commits. It's not so easy to claim that one is intrinsically more secure than the other. As someone in the cybersecurity field, I prefer FOSS software. But the situation is more nuanced than how you present it.