I realise that I'm risking being contrary, but my question is serious.

How would I know that an app has had lots of developer eyes on it or not? It's crazy difficult to uncover the latest known security posture of open source software.

Finding out eventually is the exact same risk I take when I use proprietary software. It requires my trust. And it's theoretically just as possible to discover vulnerabilities in closed-source software (Windows, for example).