a lot of open source software had a false sense of being secure with the assumption that someone else would have audited the code
Do you have examples of people saying this? I don't think I've come across idea being espoused...
I've certainly seen people interpret Linus's law to mean this. (https://en.wikipedia.org/wiki/Linus's_law).
I do not have an example for this, but the most ridiculous argument for open source software (at lease for most people) has always been that if the software has a bug you could simply fix it yourself. Funny enough this has actually become kind of true with new LLMs.
Did you not fix bugs in the oss you run, pre-LLM? Or not bugs, just your own changes? Being able to just grab the source and tweak it without needing to try to RE or wait around or convince the owners/developers to do something I wanted to happen was one of the biggest selling points.
Most people did not do this, no. Or even if you did, upstreaming the patch was even more uncommon.