Otherwise, you need to be some kind of freaking retro-engineering expert.
Nah, often software is stupidly easy to breach. Often its an openly accessable database (like recently with the Tea app), or that you can pull other data from the webapp just by incrementing or decrementing the ID in your webrequest (that commonly happened with quite a number of digital contact tracing platforms used during Covid).
Very often the closed source just obscures the screaming security issues.
And yeah, there are not enough people to thorouhly audit all the open source code. But there are more people doing that, than you think. And another thing to mind is, that reporting a security problem with a software/service can get you in serious legal trouble depending on your jurisdicting - justified or not. Corporations won't hesitate to slap suit you out of existance, if they can hide the problems that way. With open source software you typically don't have any problems like this, since collaboration and transparency is more baked in into it.
"Risked his life saving baby Harry"? When did that happen. Last time I looked he just fetched baby Harry out of the empty ruins of the Potter house. Or you mean risking that a brink lands in his head, doing nothing to Hagrids half-giant head?
Hagrid beat though. Better than the weirdo Snape, who was only bothered about people being murdered, when they got to the girl he got friendzoned by.