I explained to finance why we had to purchase licenses for for a UI library. To justify the costs, they asked what the alternative was. I told them we don’t have the talent or resources to develop our own UI library… But I offered up free open source alternatives.
Unfortunately the FOSS stuff never gets approved by IT due to vulnerability / threats.
Depends, sometimes not always. Having source available makes it easy for hackers to find exploit but also makes it easier for community to identify and address exploits.
So… For a large active community project, it’s likely fairly secure but for smaller projects with 1 or just a few developers it might be vulnerable.