Do these things really matter unless you are going to verify the software yourself? (and if you are, kudos to you!)

While, in principle, users could organize their own communal verification programs for open software, that does not happen in practice, even when the software is widely used and needs to be safe (or at least secure - OpenSSL...)