Yes, important to keep in mind that software being open source doesn’t automagically make it secure™.

Still, I think it’s important to stress that the benefits of open source outweigh the risks when it comes to security (imho).

The thing is we only know about these vulnerabilities in such great detail because the projects are open source. God knows what kund of vulnerabilities are hidden in closed source software.

Don’t forget it’s usually just US citizens who even get the chance to jump onto such class action suits. The rest of the world don’t even get their $5.

Have you looked into Syncthing? It’s super easy to set up without having to configure any ports/proxy/etc.