That's a bizare thing to say...
The reality is completely the opposite. OSS implies many eyes looking at the source and monitoring repo commits, which therefore results in security holes being caught quicker.
FOSS shops tend to have a "release often" philosophy. You do not need to wait several months and jump through flaming hoops to have a zero-day bug fixed -- you simply "sudo apt-get update" (on Ubuntu) and all known vulnerabilities in standard packages are fixed.
Also, you seem to be assuming that FOSS = niche. Android runs a third of all smartphones, and is FOSS. Apache, nginx, and PHP run a large chunk of the internet, and they are all FOSS. Chrome is based off Chromium, which is FOSS.
Although you might have more eyes looking at IE6 than Chrome, you certainly have a lot more users using Chromium technology as opposed to Microsoft's latest half-baked attempt at a browser, and with a large community of developers reviewing and contributing code, and a fast-paced release schedule (Chrome is 35.0.1916.114 after less than 5 years in the field) implies that bugs will be caught and fixed far quicker.
My point was that it isn't simply a hard and fast rule of FOSS = security or commercial being the opposite.
Commercial products can be as secure as FOSS products, just like FOSS products can be equally as insecure as commercial products.
There's no universal law that applies.
You blow a horn about Chrome being on version 35 in less than five years. I'll argue that BECAUSE of major version changes and too regular updates there's a bigger chance of introducing new security holes and/or bugs, whereas the likes of IE retain stability with more infrequent updates.
I'm not saying the above is the case, I'm simply making an argument against yours.
There is no universal rule here like the OP seems to allude to, it's purely a case by case basis.
FOSS is cheap to implement in small environments but often not the case in larger ones. Not when all aspects are considered.
*****
I don't want to make it sound like I'm all for commercial and have something against FOSS.
I'm running an 85% FOSS shop here, I'm just stating that the OP isn't correct in their assumptions and haven't considered all factors.