And even if they do lack review processes, it can't be said that putting in even the strictest of review procedures would stop a determined attacker.

It's almost childs play to hide a security vulnerability into a large 1000 line PR, down some error path, through a use after free, hidden deep in a library, a buffer overflow, a debug handler, or anything else really.