there's definitely nothing we can do. This is very much not true. Understanding what any executable does is possible without the source code. In fact, if you

there's definitely nothing we can do. This is very much not true. Understanding what any executable does is possible without the source code. In fact, if you are looking at the binary, you know exactly what you are dealing with, and don't have the doubt about what the build chain actually does with the source. potential vulnerabilities were stopped by it being open source. This presumably comes from "many eyes make all bugs shallow". But operationally this is not true, because there isn't really, except for rare circumstances, any useful review.