> The repository doesn't include all of the code that gets included in the app, because it has dependencies.*
> Software is guilty until proven innocent
I'm not saying you're wrong about any of this, and I don't trust this app myself (mostly because JS dependencies are hard to trust for various reasons), but...
I also can't think of any usable app that meets your criteria for trustworthiness, including some made by Google itself.
At this point, building much of anything requires standing on a teetering tower of dependencies that users can't and won't audit.
The question becomes where one draws the line. I think drawing the line at "anything that touches my Drive files" is reasonable, but we (meaning computer users) spent decades downloading sketchy executables for our Windows PCs. Although many things are browser-based now, many of us still do download native executable freeware from the web.
If you think I'm not offering a better perspective, it's because I'm not. You're right, but total security also currently means using very little of the software that's available to us.