It does not have to be the average person. If it's open and if there is enough interest in the community, organizations can contract security professionals to audit the code. This has been done for several crypto projects even in recent history.