Like most things, it's about balance. All changes to open source software must be approved by the community managing it, and if that community is lazy or poorly managed or simply too busy then there's an opportunity for new vulnerabilities to be created, either accidentally or maliciously.
But for well managed software, as other people have said you can get more changes more frequently, more security as many people are evaluating the code base, and greater attention to what users want rather than what's profitable. Whereas with closed source software there is a greater focus on profitability, and sometimes that leaves vulnerabilities open when development is rushed and/or vulnerabilities are not seen as important enough to justify the cost to fix, but sometimes that tendancy towards profitability can also ensure the product stays a market leader. Steam may be a good example of a good closed source product.