Perception vs Reality: A Data-Driven Look at Open Source Risk Management