I take your point, but it's really not practical. Any large codebase is nearly impossible to scour for this kind of thing, particularly a web browser which is

I take your point, but it's really not practical. Any large codebase is nearly impossible to scour for this kind of thing, particularly a web browser which is an immense mound of source. There's so many ways to build in a backdoor, so many ways to build a way for you to later load a back door, that it's not plausible, even for a seasoned developer, to reliably find it. You have to stop such things with source control. The surface area of a new fix or feature is much easier to analyze for vulnerabilities, intentional or not. I do this on a daily basis, and it takes work.