popularity does not correspond to vetting (see the recent parity multisig vulnerability), and highly reviewed software is not necessarily popular (how many people know about libsecp256k1?).