It's subjective opinion to trust Linus/FSF more. On top of that Linus doesn't review every piece of code that you run. Some random people vet plenty of code that the distro contains. In addition, I would say it's easier for the NSA to make subtle changes to open source software to sneak in heartbleed-style vulnerabilities under the guise of new unrelated features/bugfixes.