NTP.org is its own problem. Even when there was more than a single person maintaining it, the development looked less than favorably upon code improvement suggestions from the community.

You've hit on the main problem. It is not open source, per se, as you imply in your message. It is community involvement.

.
Where you have a community that is involved and stays involved, bugs are shallow. When you have a community, such as NTP.org, where suggestions are pushed away, bugs become very deep.

... and the code written in nice air-conditioned offices in Redmond, Washington has shown itself to be so much more secure over the years ....

"Everyone" does not need to do it. You've set up a premise that fails on face value.

I think the big issue with the Heartbleed bug was that the OpenSSL code base was so egregiously poorly written and maintained that eyeballs started bleeding whenever they looked at it. imo, the OpenSSL code base never had enough eyeballs looking at it to make its bugs shallow. It was painful to look at, so eyeballs avoided looking at it.

.
I still think that Linus' Law hold true, or at least is a very good guideline. I think exceptions like the OpenSSL code base are needed to hone the point that Linus' Law makes.

I also take issue with the headline, as I do not think there is any one right solution for improving security. The improvement of security is a multi-faceted endeavour and an ongoing process.

So untrained people are now monitoring their health using uncalibrated devices in uncontrolled circumstances.

.
Yup, that sounds like a recipe for success to me.

Surprisingly, though, those very same untrained people will be saying how wonderful it all is. If for no other reason than to try to justify the fashion accessory on their wrist.

The question in my mind is whether there is enough money in the "other services" to support the huge, bloated corporation we know as Microsoft?

.

If I were a Microsoft employee, I'd begin looking to restart my career somewhere else.....

If that is what happens, then other measures would need to be taken to assure new CA's are trustworthy.

.
If the same problem continues to recur and nothing is done to prevent it, then the whole web of trust will fail.

Never optimize what should not have been done in the first place.

.

new jobs will open up for people who have to dig cars out of snowbanks

a new employment category autonomous assistants will "drive" the self-driving cars in poor weather conditions

.
Also, I saw no mention by Amazon about their concern for the safety of the people who will be living under the threat of the Amazon drones falling out of the air. Maybe that is why Amazon is moving so quickly, their concern for safety is not as the level it should be.

.
For example. Be transparent with any equipment lists that document what equipment are in the employee's possession. Share the list at least yearly with the employee so there are no surprises (and the resulting badness) if an employee leaves. There is little else that generates ill feelings than an out of date equipment list for an employee (what do you mean I have to turn in that laptop? I turned it in two years ago. What!?!?! You want me to pay for it? ... etc., etc.).

Provide a great work environment so employees don't want to leave.

Look at what you think concerns you when an employee leaves, and then think about what you should do while the person is an active employee to prevent your concerns from occurring.

Don't solve the problem after it occurs, prevent it from occurring.