Sure, my point was that open source doesn't matter anything for this attack vector. I have yet to see anyone with reproducible builds being used and cared about

Sure, my point was that open source doesn't matter anything for this attack vector. I have yet to see anyone with reproducible builds being used and cared about in production. It's too expensive, and impractical. How are you going to verify that a system you just installed is OK? An attacker would've patched the md5sum (or other hashing) utility as well, so you'd need to mount you whole filesystem from another (trusted) machine, run the checksum on each file from that other machine, and compare with a known-good (through a reputation network) list. And in the mean time, a million monkeys have social-engineered your secretary's machine through a Farmville js trick and pwned your network 3 ways from Sunday.