I always found Linus' Law -- note, coined by ESR, not Linus -- quite... uh... shallow. It seems trivially obvious but is subtly misleading because it makes a quantitative argument ("enough eyeballs") without addressing the qualitative aspect, i.e. whose eyeballs they are matters more than anything.

A 1000 of us regular devs scanning a piece of code is not as effective as a single review by, say, Tavis Ormandy. So "enough eyeballs" is only "enough" when one of those set happens to belong to a Tavis O. or the likes.

Not to mention, this assumes a 1000 of us even look at the code, which is statistically never true. Approximately 100% of us just install the software without looking at a single line of code. Hence the code auditability aspect of open-source software never really applied. And hence, "supply chain attacks."

Unfortunately, this misguided "law" was taken as gospel by many, and as you found out, still is.