Public key - is a key where you can "deposit/transfer" your funds. Sometimes it called public address.
Forget about public keys for standard bitcoin use. You don't need them. You need the address. The address is what you give to someone who needs to send you BTC, and you send your BTC to other people's addresses. Your public addresses will be reveled on the blockchain when you make an outgoing transaction from the address derived from that public key. But that's not something you need to worry about unless you get into the technicalities of Bitcoin.
The address is a shorter hashed form of the longer public key. But one doesn't substitute the other. My software won't allow me to send BTC to you if I enter your public key in the 'send to' field.
Close Source - is high risk because you can't be able to see or check the code if there's something wrong.
Open Source - is low risk because you can see ot check the code if there's a bug or something, or safe to use with.
Depends on how popular the software is. When we are talking about something like Electrum, it's a piece of software that has been verified numerous times by multiple parties. But if it's a brand-new, unpopular, and unused software, it doesn't matter much if it's open or closed-source.
Consider this:
You find a piece of software on the internet where someone "promises" it solves a particular problem. It's new, and there are no records of anyone every verifying it besides the owner and his fake friends. No security company has ever checked it. There is nothing about it on the internet. You have no idea how to verify the code yourself, and no one else will do it for you.
Do you think this software that no one has ever used or checked is safe because it's open-source?
There is a thread in the reputation board right now where a user created a fake seed checker software. You know what? He says it's open-source. You feel like using it to check your seeds?