With closed source software, you have to wait for the company that made the code to patch it.

Right, which is what I consider to be the more critical question (as I implied in the remainder of the message). And which I consider to be a different question than "is open or closed source inherently more secure?"