How quickly are vulnerabilities usually resolved?

That varies greatly. Active projects can respond quickly; abandoned projects cannot. The same also applies to closed software.

Therefore, do not only look at the license, but also at maintenance, reporting process and release practice.