The repository doesn't include all of the code that gets included in the app, because it has dependencies. It links those dependencies on the github page, but you have to verify that the dependencies being linked to are the ones the build actually uses. Then check that you like what's in those dependencies. At first glance, a forked version of one of the dependencies is pulled from his own repository instead of the repository linked on the page, so you have to make sure you aren't vetting the wrong repository. Then the release archives package in Electron for you, so that's another thing you're trusting if you don't build it locally.
It doesn't mean anyone is doing anything wrong, but even if they have good intentions good people pull in bad dependencies occasionally too.
Developers as people are innocent until proven guilty. Software is guilty until proven innocent, especially if there's a higher chance of a security risk. Not everyone can assess that well for themselves.