OSS has its own attack vectors which closed doesn’t, i.e. malicious code snuck into upstream libraries and going unnoticed for weeks, or outright buying popular oss code from devs to abuse.

Neither is more secure.