Rogue hackers don't see the OS code (per se.), they are basically aware of the api's having problem with injected bytes in the os libs. These folks have there own team wherein they try to break apart the security of the lib/exe. Once they succeed they share within there confined groups for other (money) purpose. So it's not the same as the Open source. In windows, I can't go beyond api description, I can't fix problems with the api itself (at the most I can notify M$ and they would decided whats to be done with it, they won't let me look into it and even suggest about it). On the other hand in Open source, the patching mechanism is so brilliant ("Read about GIT"), even if I manage to push my code changes to the kernel, the discrepancy would be noted very fast and my "pushed" code removed from it. Ofcourse along with that the folks at kernel.org would also identify the vulnerability through which I tried succeeding my code changes into the kernel.