I'm sorry but this all comes to moot. For any opensource project of substantial size, you absolutely "have not a much better ability to evaluate this from the i

I'm sorry but this all comes to moot. For any opensource project of substantial size, you absolutely "have not a much better ability to evaluate this from the inside by getting on mailing list and trackers". All of that is irrelevant and a waste of time at best (at worst you're deluding yourself). Unless you're one of the few people on the planet who are good at auditing code for security vulnerabilities and devote the time to do it (or pay someone else to do the same), you have no stable basis to be making any assumptions as to the security status of a codebase. If this doesn't convince you, look at all the security-critical opensource projects that are riddled with security bugs. There is not a single one of them that hasn't been compromised time and time again. Sad but true.