Well it is indeed a point that it is yet to be reviewed by an acknowledged security company, and toxcore's last commit was in 2015. I'll search for one of these threads though