Good actors do it mostly for money and fame, bad actors do it mostly for money. Both actors do it for open source and closed source software. Isn't it a good t

Good actors do it mostly for money and fame, bad actors do it mostly for money. Both actors do it for open source and closed source software. Isn't it a good thing that anyone can effectively use tools to check for potential vulnerabilities? This is just speculation, but I think open source projects may mature faster in terms of security because the low-hanging fruit is maybe found faster than in closed source projects? Another interesting case I think about a lot is the classic AOSP vs. iOS. Apple tried to sue Corellium for making it easier to research iOS. Then Apple started the Apple Security Research Device program to make it easier for researchers to do iOS research. These two things seem to me to be a kind of involuntary open-sourcing of iOS. Why did Apple see Corellium as a threat and why did they provide researchers with these special devices?