When they catch a shipment of drugs being smuggled across the border, do they say 'we got them all'? You have to assume for every number X that you intercept, you miss X * Y.
(This is also different from what the GP argues.)
Not every malicious actor is a financially driven crypto-miner or credential stealer. It seems likely that some exploits are going to be sat on or used in a highly targeted manner such that we may never know they exist.
But again: it’s impossible to argue against a “silent majority” claim. The argument passes the sniff test for drug smuggling because we have separate evidence that most drugs are not interdicted. We have no such separate evidence for open source supply chain compromises.