There are more entities we have to trust in this matter. For example when I download whatsapp on my phone I trust that Google hasn't injected its own spyware into the binary, because there is no way for me (as an end-user who doesn't want to hack my own phone to get root access) to verify that the binary came directly from whatsapp.

As much as Jobs revolutionized the smartphone industry, this is the long-lasting legacy we will have to live with for decades (or forever?).