This is true. Even projects with good reputations get caught up in shit like the XZ back door in Linux.

If you haven’t read up on that fiasco, you really should look into it. It got way too far before being caught all because people suck and ruin things for others.