Fundamentally the situation has not changed much. You redownload the code every time and servers could deliver tailored compromised versions if ordered so by so

Fundamentally the situation has not changed much. You redownload the code every time and servers could deliver tailored compromised versions if ordered so by some TLA. Which means audits have limited values since they can't attest that what they have seen is actually what anyone gets. Compare with native tools which you only download once, can check its signatures and which strive for reproducible builds so that multiple parties can verify them independently.