Yeah, that’s something I’ve always wondered about, esp. the free OS’s.
Why especially the free ones? At least where we have source code, we can identify the breaches. With proprietary software, you’d never know.