They argue that having access to the source code doesn't mean anyone is actually looking at it, or that all the bugs have been found and fixed. They remind us that open source users who install precompiled binaries are essentially running closed source software since they can't be sure the executables match the source code. Certainly publishing source code for independent peer review increases the likelihood that security flaws will be identified and fixed in a timely manner. Access to source code is probably a good first step toward better security. But access to source code does not by itself guarantee better security.
Someone has to actually look at the code to find and fix the bugs.
And a certain level of competence is required as well. A million clueless newbies reading source code they don't understand probably won't do much for security. Thousands of competent coders carefully reviewing each others' work can probably improve security for all. 15 Bruce Schneier, Ibid. Technical report, Computer Sciences Department, University of Wisconsin, 1995.