Exactly! And that means they inherit the vulnerabilities of that middleware, and those are disclosed publicly regardless of what they choose to hide.
This is all a big charade. Every undergrad knows that security by obscurity does not work.
Discourse shows that it is possible to stay open source, to build a sustainable SaaS business AND to keep pace in the vulnerability landscape rather than trying to hide from it.