Thanks for answers, guys
I agree with Dave that open source is not safe heaven if you are using auto updates. To be sure in security you should read every update report. But it anyway makes the story a bit more transparent and a bit calmer