One example they use in the blog post is curl. Not maintained or developed by a billion dollar company.
I suspect open source projects are better off than proprietary software - they already have many eyes on them, whereas commercial software that’s not a prominent and profitable target (e.g. windows, ios) hasn’t had much attention until LLMs made attacking them significantly easier
The average enterprise software is swiss cheese. It seems the hacker news type that likes to post just doesn't realize how much business/enterprise software exists out there. An F100 company has thousands, maybe tens of thousands of applications that you've never heard of and never will unless you work for them. Industry has applications ran by relatively few people, but it's keeping processes that make the modern world work alive.
Worse is everyone is like "Well, this stuff is protected or air gaped". Yea, it's behind firewall, or even private networks commonly, but the moment you get inside that network you have tons of lateral movement and could cause unbelievable damage in minutes.
> I suspect open source projects are better off than proprietary software - they already have many eyes on them
This has been disproven by the sordid history of OpenSSL. It was open source, critical, and full of holes.
https://www.mend.io/blog/how-the-heartbleed-vulnerability-sh...
Single datapoint does not prove anything at all, but it is a data point.