How is this any different than any app/executable/script period? When you download VLC did you read all the code to check it's not installing a root kit? When y

How is this any different than any app/executable/script period? When you download VLC did you read all the code to check it's not installing a root kit? When you added some python lib do you go through all the code and make sure that on the 20th run it doesn't upload your private ssh keys? Have you checked all the vim or emacs code in your latest download before running it? Maybe I'm missing the issue but they all seem about the same level of bad. Am I missing something?