Even cots/non-foss likely uses foss libraries somewhere. Also keep in mind that foss doesn’t mean the software can be changed at any time in the version that gets distributed. There’s usually checks and reviews when someone wants to contribute. A commercial software also isn’t immune to bad actors. I trust a reputable piece of foss far more than a sketchy company’s code