The thing with ‘malware’ in free/open software is that you CAN (or somebody else will eventually) discover it, if such slipped by.

There’s no such choice with closed-source, where the seller/corporation often serves you Trojans intentionally, unknown to you (for data collection), and then even asks you to pay often for such a spyware.