It's open source
A few years ago there was a scandal where Chromium was downloading an encrypted payload at build time, this was discovered by the Debian package maintainer for Chromium, and it was only found during the build. Open source isn't a panacea to ward off all evil.