Compare something like Sparrow Wallet to ColdCard. Both had source available. Sparrow is an open source project (true open source - free to modify and distribute/use), a public good that people should audit and there's no pressure on @craigraw to pay for bounties, etc. ColdCard is a commercial company. They are selling a product and they are responsible for security. Their source code was made available, but people couldn't reuse it (license had forbidden it). So essentially there was almost no incentive for people to audit it. People who are not paying ColdCard money won't audit it because they can't use the code anyway, so they don't care. People who are paying ColdCard money assume that a commercial product is well audited by third parties, because what they're selling is a security product. They thought they were paying for security. ColdCard was selling a vaporware though, which is basically a scam. Nicely looking calculator with buzzwords instead of real security.