Nobody sells a 100% open source phone. Everyone uses broadcom, motorola, TI, etc. chips which have propriety firmware. (I'm aware there are a few obscure phones that claim to be 100% open, but not many people use them, not available, etc.)
The "its only secure if its open source" argument only really works if you compile the source yourself - otherwise you
're just trusting that the binaries on the devices are in fact compiled from the source that is published, in which case you may as well trust anything they say.
Ask your self:
Would Snowden use this phone? Your answer to this question is the same as the answer to the question "Is this phone secure?"
I guess I'll get downvoted for this sense it goes against the Apple circlejerk, but this issue is more important to me than magic internet points.