Security researchers do find and report buffer overflows in closed source software, which then get fixed by the manufacturer. It happens.

But yes, I also wonder about the balance of bugs in similar open/closed source software.