It seems to be time for this. There's a war on. We're now seeing regular attempts to sneak backdoors into open source code.[1][2] And those are the ones that have been found. There was a Linux kernel bug where someone put a test for root in as "if (uid = 0)" instead of "if (uid == 0)", so that when a rarely used system call was made, the process became root.[3]
The EU is most concerned about "Class II software". The stuff that runs industry.
[1] https://acronisscs.com/blog-open-source-backdoors-in-the-wil...
[2] https://www.zdnet.com/article/open-source-software-how-many-...