Because typically you can't get away with sneaking code like `void keylogger() {` into freely available code. Even if hidden well, it will be discovered sooner or later with enough eyes. The only insecurities "allowed" by open-source code are accidents, and these can be discovered much quicker than accidents included in proprietary code.
It's pretty clear that 'security' has never been a concern for Linux desktop developers, what software would you choose to run on your open source hardware instead of linux?