I would imagine what it means is that in practice open source just gives a false sense of security that someone must have looked at it.