Not if the bash part then turns around and installs a random binary, which is often the case. How do you know how thoroughly it's been audited by third parties?

Not if the bash part then turns around and installs a random binary, which is often the case. How do you know how thoroughly it's been audited by third parties? Does it have a security patch mechanism built into it?