If these projects were doing proper code audits as the code was added, then the project might progress slower, but it would be a lot safer... Just sayin.

Code audits are nice, but they definitely don't magically fix vulnerabilities. Even if everyone is trained to find and patch vulnerabilities, you'll only catch the simple attack paths. Things like unsanitized inputs or sql injection (It's depressing that these attacks still account for the largest amount of vulnerabilities decades later). The truly dangerous vulnerabilities like heartbleed or spectre require you to spend time fiddling with code, testing outputs, and chasing down dead ends until you find the correct path to do it.

Yeah, I agree though, its quickly piling up and the OSS maintainers cant keep up. Even Microsoft is having this problem but since their code isnt open source its easier to hide. It still shows though when their bug patches increase in size every time. Not knocking them, they're doing their best just like everyone else. It's just people like to look at the problems Open Source is having and pretend that their own house isn't falling apart also.

Honestly, the increase in vulnerability related to Microsoft isn't increasing nearly as fast as it would be expected, likely because the vast majority of vulnerability hunting is already conducted against Microsoft, so there is already a constant stream of things being identified and patched.

The products that don't normally get targeted are the danger spots, especially because a lot of them don't have proper vulnerability reporting paths since it's not been an issue before. Those get compromised and six months later someone discovers it and we get to play catchup in trying to find out what the attackers did.

What I'm more interested in, honestly, is how Apple is faring. Haven't heard of very many exploits being found on that side, or too many gogantic patches being pushed either. I'm not a fanboy, and refuse to buy an iPhone, but I do think there's a chance they might have realized continuous code audits are the only safe way to go.

Apple is just as vulnerable as any company, they just have a small market share especially in the enterprise industry as well as a small amount of products. The vast majority of attackers and security researchers focus on Microsoft for a reason. If you can find a vulnerability there, something like 80% of your targets will be vulnerable. And the list of products you can target is much higher, there are multiple versions of windows that companies refuse to move off of, all of the Office products (which has an even higher market share), exchange, internet explorer and edge, and all of their cloud products, and that's just barely scratching the surface.

Back in February Apple had to release a batch for several buffer overflow vulnerabilities (which should be caught in a code audit) including one with the ability to write to kernel memory. We just don't hear about it because there isn't enough people affected to surface it as a big security issue. They also don't have a good vulnerability reporting flow and so I would always treat them with extra caution. They haven't been tested enough to have a fast turn around to problems, and they don't have enough market share to have active third party hunters, and so you should expect them to be vulnerable for a longer window of time.

Edit: OpenBSD does continuous code auditing btw.

And still consistently runs into vulnerabilities only discovered by third parties. Code auditing is a step, not a solution.