That's my conclusion, yes. With the third (middle) option spending at least a day extra, potentially more, for each closed-source release.

Until now, I've been reviewing every release of all my apps and Graphene, which takes me about a week of work time per month, just to be secure from gangsters hacking anything other than the NSA. I'm not even secure against nation states.