True, but that's a lot better than your CPU running a non-stop Java webserver / rootkit.
Considering nation state actors have been consistently backdooring everything they can get their hands on (network equipment, CPUs, software, storage devices, you name it - and they've done it without the manufacturer ever knowing sometimes) the assumption that such an open source project would not have it and it's "a lot better" is based purely on wishful thinking.