Wasn't there a post here about how little review open source software actually gets due to the highly specific knowledge required to identify vulnerabilities?

something like: https://www.itworld.com/article/2922074/significant-virtual-...

Seems like creating a foundational open source project and introducing a few key bugs would be the best way to hide in the open.