Somewhat of a different take from what I've seen from the other comments. In my opinion, the main reason is this:
Companies have basically two reasons to do safety/security: Brand image and legal regulations.And they have a reason to not do safety/security: Cost pressure.
Now imagine a field where there's hardly any regulations and you don't really stand out when you do security badly. Then the cost pressure means you just won't do much security.
That's the software engineering field.
Now compare that to open-source. I'd argue a solid chunk of its good reputation is from hobby projects, where people have no cost pressure and can therefore take all the time to do security justice.In particular, you need to remember that most security vulnerabilities are just regular bugs that happen to be exploitable. I have significantly fewer bugs in my hobby projects than in the commercial projects I work on, because there's no pressure to meet deadlines.
And frankly, the brand image applies even to open-source. I will write shitty code, if you pay me to. But if my name is published along with it, you need to pay me significantly more. So, even if it is a commercial project that happens to be published under an open-source license, I will not accept as many compromises to meet deadlines.
I've had chronic fatigue+pain until I recently found out that not eating wheat is apparently doing wonders. And it's just absolutely wild seeing myself go out to do the optional side quests.
There's a road directly intersecting in front of the house I've been living in for four years, which I never walked down, because there was just nothing at the end of it that I had to get to.And then you turn right on that road and you're instantly in the middle of the thickest greens, which is fucking nice.
And there's this cool mound / rock formation about two hundred meters downhill from here, which I could always see somewhat on top of and wanted to go up there, but again, just didn't until recently.It's so much bigger than I thought. Like, I'll have to head up there another time, because I couldn't explore it all without proper shoes on. Which is the other thing, much like the instant nature, this was just instant mountaineering feeling. So many cool places hidden in plain sight.
But really the wildest thing was that I went up that mound after I had already walked around town for half an hour. Like, damn, I knew that normal people didn't get exhausted from activities the same way, but it kind of never clicked for me that you could actually chain optional activities. No wonder people always have so many stories to tell, when you can head out once and then experience like three or four things in a row.