Yeah, the author’s example is an odd and unlikely one. The real security concern is “you’ve audited the source code for some level of safety criticalness and v

Yeah, the author’s example is an odd and unlikely one. The real security concern is “you’ve audited the source code for some level of safety criticalness and validated it. What guarantee do you now have that the binary you’re told was built from that exact state of source code, actually was?” A concrete example being the UK’s audit of some Huawei firmware source code, which basically concluded “in addition to the issues we found, the builds are highly non-deterministic and we have no way of verifying whether a given firmware blob was actually built from this source or may have differed in any number of ways”