What guarantees do you have that running apt won't install a rootkit or that the compiler the foss source code was compiled with wasn't malicious?

At the end of the day, we largely trust canonical or the distros maintainers to not do anything malicious, even by accident.

I see Libre cloud as a similar situation, though with more avenues for larger-scale abuse. Hopefully, just like with other things FOSS, the community will validate that everything is fine and the risk is minimal.