Don’t get me wrong but if virtually all modern software infrastructure lives on top of open source and they’re mostly fine then I’d imagine that you can make a scheduling webapp secure independent to if it’s OSS or not.
It’s OK if there’s another reason for this transition, just be transparent about it and don’t treat your users as children.