I feel this way about open source generally.

Lots of cool stuff that I happily use, but the bar to installing something that gets to see my password (OS, terminal, input handler, etc) is very high.

Not a popular take, but I'd rather run something from Valve or Google for the same reason. I trust there to be more vetting if a corporation is putting its reputation on the product than a toy I found on GitHub.

It's a bit of a myth that open source leads to more eyes on the software. Most people just install it and trust that somebody else did the audit.

Something with a vibrant community of maintainers? Maybe.

Something that's too big to personally audit but too small for that community? I'll pass.