That is a common critique but a baseless one in the case of the major open-source enterprise programs like Linux, Apache, etc. Those programs are rock-solid in security.
Narrowing the discussion to only enterprise versions does not include the whole open source world. Having worked in the enterprise server industry for 25 years, I am well aware of where enterprise Linux is and how long it took to get there.
The premise I was addressing was the assertion that open source in and of itself creates more secure solutions. And his reference point was the personal desktop, not the enterprise server. If he must buy one of the enterprise Linux solutions to get the level of security you speak of, the price part of his argument goes out the window.