The thing is, if thousands use it, then you'd know if it's unsafe...

Beyond that, yeah, nothing is absolutely certain in life except death and taxes...

in security where breaches can cost a lot of money, relying on heavy use as an indication of trustworthiness may not be a great idea.

For example OpenSSL was and is used by lots of people, this has not stopped it having a lot of security problems...

And true once the vulnerabilities get published you get to know about the problems more quickly but then in a world of targeted attacks and professional exploitation that might not be great comfort..

This assumption fails in the network connected world where a program can download custom instructions after installation.

It doesn't fail, it's still as usable as ever -- just not infallible, which nothing is anyway.

The dynamics of something with a larger user base being more trustworthy don't change because we're on the internet. It's a simple network (no pun intended) effect.

If the program "can download custom instructions after installation" then a large user base still means that users will be bound to find it sooner or later (and make it public/fix it) and it makes it less likely to be you (because you're 1 from 200,000 downloading it, not 1 of 20 or 200).