I had faith in the people.
They had jobs and reputations and self-images about being "good" at what they did and psychological needs. And further, they had the same incentives as me to not ship bugs when they could avoid it. And I could see, in general, the conversations humans were having, first on usenet and listservs and then on all the little situations on the larger internet.
I didn't trust them blindly, but if a bunch of us all seemed to be okay with the software for the mysql database or the apache webserver. And while I certainly have no idea who those specific folks were I do know how human communities work. When folks found malicious things in, say, a ruby yaml parser or a node package, it was loud.
And like all human scale things, the pacing was much slower so that things like a person's situation in a community and the human trust associated with that trust were things we could evaluate.
I can't evaluate the output of an LLM in the same way. It does not have the same incentives or needs. And it's not deterministic- if you recall comparing checksums between what you downloaded and what the folks putting the software published, then you understand what I mean here when I note that we could trust-but-verify a lot of things.
With the output of an LLM, it actually is important to check over, much of the human-level surface of how we review software is stripped out.