Yes, that's 100% correct. Security by obscurity is really bad, especially because with open-source projects, hundreds of people can review the code, find bugs, and improve it. According to statistics, significantly more cyberattacks succeed on closed platforms where the code isn't accessible. For anyone who wants to see the statistics, here's a link to some data—or rather, a statement from a security economist: https://www.researchgate.net/publication/220891308_Security_...