It's not just about trusting that project. It's about trusting that project to understand relevant interactions with the rest of your system, which may include

It's not just about trusting that project. It's about trusting that project to understand relevant interactions with the rest of your system, which may include components or configurations that project's authors have never heard of. Developers can screw up even with the best of intentions. I trust distributions more because interactions between components is pretty much all they deal with. That's their specialty. I'm a distribution developer. I know first hand how often upstream projects screw up due to naivety, because it's my day job to fix their bugs.