Regarding effective security, even with your definition focussed on human access, I don't think current open source community standards are sufficient [with which, note, I didn't meant they couldn't be an improvement]. The worst case scenario with a system vulnerability for a Linux OS would be a few ten thousand computer crashes, which the sysadmins have to repair by debugging, running a different Linux version, or getting a patch through another internet-connected computer. Addressing system vulnerabilities includes ticking your own system. In case of nuclear facilities, the equivalent worst case scenario should be better avoided. (Staying with the mischievous human factor, you needen't think of al-Qaida. In the USA in the first half of the eighties, there has been a case of sabotage of safety pumps and two cases of sabotage of back-up diesel generators by insiders, and one sabotage of external power lines.) Meanwhile, ticking your own system can be done only in a limited way, you have to rely on simulations and assumptions. *Lunatic*, n. One whose delusions are out of fashion.
Why is outside control qualitatively more difficult for nuclear? guaranteed to evoke a violent reaction from police is to challenge their right to "define the situation." --- David Graeber citing Marc Cooper