According to the "security by obscurity" law, you cannot really open to the public something which had always been hidden from it. It would open the door and expose people still using it to a huge attack risk imho

I understand that, but imagine the sheer amount of 0-days which will flood the black market the second day Microsoft would expose a massive, un-audited codebase to the public. I am not saying they should not do it, I am saying that it may took some time to audit it

My 2c: Binaries with private symbols have leaked in the past, hexrays + private syms is almost as good as source, and no 0day flood has happened. When entire NT4 and 2k source leaked, no 0day flood happened.

Is there *any* example for an 0day flood from open-sourcing?