How true is this?

Indeed, only a handful of people in the entire world can code review cryptographic software like OpenSSL. It is very likely easy to hide theoretical (theory in the mathematics-sense) backdoors in open source since the cryptography community is super secretive (only privileged people have access to academic literature on the subject!).