Can you really trust a non-open-source desktop wallet?
Yes! Iff they hired top security experts and regularly undergo audits.
The only reason some people don't is the existence security-by-obscurity : Certain services only rely on the fact that the source code is not published for security. For as long as this is not the only protector, there is no reason not to trust! Using non-deterministically compiled binaries of open-source software is unsafe anyway.
For me, well-reviewed code is more important than open-source-ness. Not everyone, not even most of somethings' users, audit the source code! Open-source does not protect programmers from ignorance and making silly security mistakes.
So personally, open-sourceness only depends on their business model, which is not linked to their security guarantees anyway!
If you are using a hot wallet, and can't see the app code, doesn't that mean it is theoretically possible for the devs to steal your crypto, even if you can see your private key?
It is possible for devs to steal your money even if they use open-source! See event-stream
The problem is not being unable to see the code, it's about VERIFYING ALL of the code. If paid audits are taking place, I would trust them more than as if I saw their code!
Shouldn't everyone be using exclusively open-sourced wallets for this reason?
No. It's generally better to use stuff whose code you can see ... so if you're the developer of a closed source software, I don't see a reason not to ... given that the most recent audit was actually recent.
The reason open-source is considered superior is because being able to access the code makes people feel safer, even if they never will.