When I read these kinds of sentiments about OSS I always think of Windows desktops and Internet Explorer in places where they absolutely don't belong. Yes, it is bad to have an enormously deep and complex stack with a big fat attack surface, almost none of which is relevant to the application. That badness isn't mitigated by the stack being commercial and coming from a single vendor.
