There are no Linux/other kernel binaries involved in the bootstrappable builds scenario either, only the 512-byte bootstrap seed of machine code, which is written as commented hex, which you then input manually and run. In theory that bootstrap seed could be backdoored, given the size that would be unlikely and auditing it should be feasible.

Reproducible builds wouldn't help here, since all binaries would be backdoored equally. They only help with situations where one build machine is compromised but another one isn't.