"it will never be enough by itself to establish that a system doesn't contain malicious code."

The track record of popular free software projects like for example Linux in preventing malicious code is very good as far as I know.