And again, a project being open source doesn't prevent the parent company from siphoning your data, all it does is (usually but not always) shed light on such practices.

A few years ago there was a scandal where Chromium was downloading an encrypted payload at build time, this was discovered by the Debian package maintainer for Chromium, and it was only found during the build. Open source isn't a panacea to ward off all evil.

Where is Google Sheets source?