Well apart from monitoring network traffic, with Ubuntu you can examine the source code for anything that you don't trust or dive into what system calls an application makes by using "strace".
Does Ubuntu provide reproducible builds? How do you disprove that the source code isn’t for the thing that you’re downloading?
The (not so) revealing thing here is that this isn’t a technical problem, but that Microsoft has just completely lost the trust of people.
You can't even look at the Windows source code, so your question about reproducible builds seems to be moving the goalposts somewhat.
Also, is there something like "strace" on Windows?
Edit: just looked it up and Ubuntu doesn't enforce reproducible builds, although with their new "Monthly Snapshots", Canonical is moving towards reproducible build pipelines.
At the end of the day, it’s just about trust and reputation. I see no technical difference here for the ability to disprove random claims.
Also, Linux does make it much easier to determine your level of trust as the different components can be analysed/verified independently (although systemd is a bit of a monolith) whereas it's a lot trickier to isolate Windows components.
This is even more true on some other distros, eg Gentoo.
Without source and rights, Windows fails completely here.