The other side assumes lots of eyes actually look, but most open source code just sits there unread. A bug can hide for years until someone stumbles on it. I am not sure how to prove it, but that is my gut feeling.