Playing around the paranoia, don't you think the NSA would have taken a minute to think, Gee we forced Microsoft and Apple to include backdoors in their OSes, maybe we should now tackle the OS that powers 90% of the web? You know maybe we could slip a backdoor in the one of the utility apps such as "htop".
Let's get serious, OpenSource is not always = Secure and Closed Source does not always = InSecure. Truecrypt is the perfect example: Open sourced but too complex to Audit, maintainers identities are unknown and offered binaries differ from manual compilation.
A good rule of thumb: Assume anything you din't write or can't audit as insecure.