The outside security company says that because of liability.

Something goes wrong with an open source app, there's no one to call for help, and there's no one liable other than yourself, yet, the security company who told you it was ok to use an open source app may become liable.