Switch to debian? You can't audit everything on your OS, you have to trust somebody. I trust debian.
In particular, it's a volunteer-run organization in which it's not unusual at all to volunteer to maintain a package as part of your day job that uses a package, and where a large amount of discretion is given to the individual package maintainer, until they choose to hand maintenance to someone else. This is perfect for an organization who wants to push security configuration weaknesses. Even if you can't get a back door in, you can certainly default to code that you have privately found vulnerabilities in, or compile with or without certain options, add third-party patches that are pretty questionable, or add CAs that are particularly easy to coerce. None of these actions look weird at all, they just look like someone who is putting work into their package and caring about doing Debian-specific work to make it work well. In particular, until relatively recently, the Debian ca-certificates package included the CAcert root cert, which was in very few other root stores, and the SPI one, which was in no other stores.
It's also the case that Debian accepts binary packages built on the developer's personal machine (and this used to be required until very recently), so it's very easy to straight-up upload a backdoor that isn't in the source. (This might have changed recently, but I believe this was true at least as recently as the last stable release.)
You think the NSA (or FSB, or whatever) can't pay for someone to maintain nginx or apache?
Outside probably hypotheticals, what we know for certain is that microsoft is attempting to monetize their new windows on the back of user's data.
To get a job at MS, you have to have a real life reputation. Once you get in, there will be others analyzing your code, and your bug may not make it to release.
To insert a bug into Debian, become a packager and you're done. Access to one of the most popular server (the important stuff is here) OSs (Debian, Ubuntu) on the web.
You're busted? Create another account and start over.
Do you know if the version of OpenSSL in your Debian has any patches to its cipher suite selection algorithm, compared to upstream? (Genuine question; I haven't checked.) If it did, and you saw someone being grumpy on a Debian bug and refusing to remove the patch, would you suspect that they were actually evil? Or just grumpy?
Remember, also, that Debian is the distro that patched their OpenSSL to ludicrously weaken the random-number generator, and the Snowden leaks confirmed that the NSA backdoored a random-number algorithm. I am not at all saying that the NSA was behind the patch (it looked genuinely like an oversight), but if the NSA wanted to be behind a similar patch, no one would think it abnormal.
Pretty common - many community distros do. Arch Linux too. Worrying for obvious reasons.
At least they're putting in an actual effort at making builds reproducible.