Isn't that riskier than using a buggy but well audited code base? So far I've stuck to TC for the simple reason that without thorough audits I imagine it would

Isn't that riskier than using a buggy but well audited code base? So far I've stuck to TC for the simple reason that without thorough audits I imagine it would be fairly easy for an attacker to compromise something like veracrypt.