When you look at source code, it can be very difficult to spot all errors.
The source is a description of what the program does, but not how. If a developer makes a mistake, it might not be obvious that he has done so, or even that it's a mistake, if it doesn't affect the apparent functionality of the program
To make sure that there are no vulnerabilities, the code needs to be reviewed for bugs. This takes people who understand what the program is supposed to be doing (in this case implementing a TLS heartbeat) to read the source code and perform tests on the program, which takes time and money. The OpenSSL team does not have the capacity to search for every potential bug, especially since it is made of volunteers. It's for this reason that the bug went unnoticed. It was only after a security researcher at Google reviewed OpenSSL was the vulnerability discovered and patched.
You need the abillity to find bugs to be able to fix them.
One a patch is released, there is always a window between when the patch is released, and when it is applied by users. Attackers have the ability to attack users in that window since they are still vulnerable. This is the same with all software.