At least with free software there is the hope that malicious code will get picked up on by someone with an interest in reading the source, who would then make that functionality known to others.