A question I have whenever I see this come up: do people who say this generally do their own personal code audit of the open-source tools they use? How can you trust anybody else to do it for you? Do you compile all of the code on your own? Can you trust your compiler? How far do you go with this line of questioning?

It seems to me that for many people, using an open-source tool does more to provide peace-of-mind than actual security assurances.