OpenSource doesn't prevent CVEs that allow attackers to take over anyway. What If you install script has a bug that lets an attacker place arbitrary SUID binar

OpenSource doesn't prevent CVEs that allow attackers to take over anyway. What If you install script has a bug that lets an attacker place arbitrary SUID binaries? Or it has a bug that deletes your entire system (Steam had this bug and the script was open and available, they weren't the only ones either).