It’s a tradeoff, not a free lunch. I still generally trust open source stuff more, but let’s not pretend it’s literally better in every way.

Totally agree.

All the push back I’m getting is from people who seem to be worried about open source somehow losing a positive talking point, when comparing it to close source systems, which is not my intention (the loss of the talking point). (I personally use Fedora/KDE.)

But sticking our heads in the sand doesn’t help things, when issues arise, we should acknowledge them and correct them.

using what was a socially engineered attack on a weak point in the entire dependency chain.

An example of what you may be speaking about, indirectly. We can only hope that maintainers do due diligence, but it is volunteer work.