I mean someone pointing out a vulnerability in a piece of software should be a falsifiable claim, e.g. "they store their passwords in plaintext"—if it's foss then just look at the source. You don't need to read the entire source because you have been given a specific part of the code to look at. You need to only look at the process between the software receiving a password and its query to the database.

And if it's not foss I don't use it, and the claim may be unfalsifiable for an outsider who isn't bothered to try reverse engineering.