I see people making the argument that the Coldcard bug was a result of the fact that the license prevented others from using their code in products, so there wasn't enough incentive to audit it.

I strongly doubt it. I bet a *lot* of people did examine it, but didn't spot the error. And unlike every other piece of functionality --- apart from entropy generation --- just looking at the output, even looking at hundreds of outputs, wouldn't have revealed the bug.