Sure, that's a solution if you think that running their binary is unacceptable. But that's begging the question.

Most people running macOS (as vemv at least is) run a lot of random binaries from various types of strangers – mostly proprietary applications, although there's also things like Homebrew cached binaries, 'curl | sh' installers, etc. Now, in this case downloading a binary isn't necessary, since there's the option of building it yourself. That's great, and it's definitely (somewhat) safer to build it yourself... but that doesn't make the binary less trustworthy than if that weren't an option. If building sounds like too much effort, you shouldn't automatically give up on using the program, but just fall back to your personal baseline policy for running binaries. And for a lot of people, for better or worse, I think that policy is fairly trusting.

Aren't you forgetting the fact that binaries aren't provided by the project itself? They come from contributors (in the project's words: 'anyone').

That's wildly different from the typical CI-built binary.