Distro maintainers aren’t infallible either. At the end of the day it’s up to you to decide where and how much trust you place and do your due diligence from there.

One thing that can be helpful when reasoning about things like this is figuring out what your actual threat model is. What does system compromise look like to you? Data exfiltration, arbitrary code execution, something else?