Open sourcing code that has no tests is open sourcing the fact that not even the developers know what their code does. Just that they vibe with it, and that you should too.
So using "open source" as a an argument for why software is trustworthy isn't credible by itself, because no one can reasonably audit the code's functionality without explicitly defined, automated tests that anchor the software to reality. Much less audit the code's security.
For anyone who doesn't know, the way you audit what code actually does is not by reading the source, it's by running the tests.