To my recollection, they always maintained that being open-source doesn't matter for security, after all