> The only way to know if software does what is intended is to use it.

No, testing and code audits also work.

No amount of use of the software will tell you what else the software does beside what is intended (exfiltrate data, etc); testing and code audits both help with that.