Yes, this is true. This is what should drive the market for 3rd party auditing and certification. Open source software makes such audits easier, more reliable, and most importantly, verifiable.

Matt