The code is open anyone to inspect, test, and improve. Vulnerabilities don’t stay hidden as they are found, reported, and fixed in the open.

That's also a myth, specially for a project of the size of nextcloud. Bugs can and do go unnoticed for years while in plain sight - with no way to know if it's been detected by any black hat.

Even worse: as soon as you merge a security fix in an open repository, people will instantly be trying to abuse it in any environment they can find that is currently running the unpatched version.