Maybe the goal isn't to monitor their people as much as gain admin access passwords to every major open source project? As talked about prior, backdoors in open

Maybe the goal isn't to monitor their people as much as gain admin access passwords to every major open source project? As talked about prior, backdoors in open source seem like a real concern. Even if source code is public for open source projects, how do we know a precompiled binary actually matches the source?