Yes. Outside of the top 20 or so open source projects, few people are watching. Often only one.
I don't think that's really true. I have open source projects that nobody else actually uses, but I still get messages from people reading and looking at the code. There's often only one person maintaining open source software, but I'd bet there's a lot of eyes on a lot of projects.
But most of them have no critical impact on essential infrastructures. Eyeballs are always their for big projects.
OpenSSL is a good example of something that was essential everywhere that had few eyeballs on it for a number of years.