Where I work they went all open-source and went down the MySQL database route because of the ability to have access to the source code and anyone in the organisation could read it.
However the reality is that no-one in the organisation has the time or technical skills to plough through thousands of lines of C code.
From my experience, the argument that code can be checked is a bit of a red herring.