If you're talking about a small/trivial/low-complexity open source library then that is probably the whole story but if you're talking about something more ambi

If you're talking about a small/trivial/low-complexity open source library then that is probably the whole story but if you're talking about something more ambitious and opinionated (like a framework or platform) then the element of trust becomes very significant.