If people don't read and understand the code, ideally before running it since part of the code might be to make some low level change to its environment and the

If people don't read and understand the code, ideally before running it since part of the code might be to make some low level change to its environment and then erase itself, then it doesn't matter whether it's there or not. And reviewing significant code bases is not something one person can do on their own, even in the unlikely event they've all the specialities to understand it all. It would require non-trivial organisations to be directed towards auditing the applications/system to ensure security. Which isn't to say that I don't think open source is a necessary condition for security. But I don't see that sort of audit getting done for everything that your average user is going to run on their phone.