You would still have to audit every the code of every released version right? Reverse engineering is obviously more difficult but someone with the right skills

You would still have to audit every the code of every released version right? Reverse engineering is obviously more difficult but someone with the right skills and tools would find it a straightforward task. Also - unless you are somehow also inspecting their CI/CD toolchain, there's no guarantee that the source being inspected matches the binaries being released - so you would need to reverse the binaries anyway.