The question isn't whether they're perfect, nor is it whether they prevent anything. But it does help a person who suspects something is up rule certain things

The question isn't whether they're perfect, nor is it whether they prevent anything. But it does help a person who suspects something is up rule certain things in and out, which increases the chances that the weak link can be found and eliminated. If you have a fair suspicion that something is up and you discover that when you compile reproduceable-package you get a different output than when you download a prebuilt reproduceable-package, you've now got something to work with. Your observation that they don't truly solve the trust problem is true. But it's somehow not relevant. It is better to be better off.