Not in a vacuum; they have to be deployed in a setting where that's possible.

> Would you include web browsers, OSs, system libraries and such in that definition?

It's sort-of a moot point, because the major products in all of these areas are routinely analyzed from a security perspective. Apple and Microsoft both spend a lot of money on security, and security researchers spend lots of time and effort auditing linux.

> If so, who do you suggest be responsible for that in an open source project?

The organization deploying the software in a security-critical setting should follow best practices when selecting and maintaining components.

There's a significant difference between engineering failures that happen even when you've followed best practices, and very preventable engineering failures that happen only because you've not followed best practices. Just because perfect security isn't possible doesn't mean we should give up entirely and not even both sanitizing input, for instance.

Additionally, OS vendors should not encourage users to use their software in security-critical settings unless the vendor is following best practices w.r.t. security. This is where I could see some bitcoin projects getting into trouble.