"Ownership is a single point of failure."
Ownership can be a single point of failure but someone owns copyright to GPL code, too. Trick is protections in licensing. A recent conversation found that the real issue, if you get down to it, is in distribution: free distribution and network effects is strongest benefit of FOSS over proprietary, shared-source model which may have every other benefit.
"A proper security audit is only possible if one can compile that source with ones own toolchain or get the binary from a source you trust. One must test and make modifications, otherwise the binary only purports to be from exactly that source."
Realize that I said proprietary, shared source. You have the source of whatever you need. One can also do something like Wirth's Pascal/P where runtime is P-code and some I/O shims. Everything else in toolchain was compiled to it. Result was amateurs ported whole thing to 70+ architectures while having to reimplement just one, tiny part. Interesting enough, System/38 design did same thing at microcode or asm level with successful port to POWER with many apps needing no source recompile.
"So you must in the end trust the companies, and trust them to release patches promptly, not delay them at the behest of the NSA (as per Snowden)."
This problem exists for FOSS, too, so don't kid yourself. The vast majority of FOSS isn't Linux: it's barely maintained and many ignore bug reports for long periods. The average is in favor of FOSS if it's major projects vs proprietary software but individually it ranges from total shit to excellence. Totally dependent on contributors or maintainers.
"PGP and SSH are both provably secure. "
They're not due to their CVE history. They just got really good with GPG foiling NSA after years of improvements with a narrow focus for GPG. GEMSOS, PSOS, and seL4 are provably secure. World of difference in how they're built. None were created with a FOSS model.
"If a patch removes an essential feature and security is bundled with it, this is problematic. If you cannot use distributed community modifications then you are often out of luck."
" Free software forks at disagreements so everyone is happy. "
It's a risk but can be countered. The counter I did in another discussion was a shared-source license that allowed fixes, modifications, and even distribution to other customers. You perpetually keep what you licensed if you keep paying optionally with a limit on per organization charges. You and a group can do anything you want with that commercial code if you're paying. Btw, the real hacker OS was provided with some (but not enough) of those attributes with features UNIX still can't fully match:
http://www.symbolics-dks.com/Genera-why-1.htm
"cannot be taken from you by law - it is public domain."
It's actually not: it's copywritten software licensed with specific terms that enforce things on you. Public domain has no copyrights or restrictions. This is a problem or a feature of GPL vs public domain depending on who you ask. Only thing both protect almost 100% is widespread distribution which any paid model might... might... always reduce.