No-one dares to commit spyware to GitHub.
I see where you are coming from, but this is simply not true. You can argue nobody concerned with his own reputation commits spyware to a public repo, but malicious actors are usually not concerned with that or try to stay anonymous in the first place.
Here is a recent example of malicious commits to a github repo: https://news.ycombinator.com/item?id=17458329
It's not so black-and-white though, hence "keeps the honest guys honest". Are Microsoft and Google 'malicious actors'? They're hungry for our data, but they often only do it when they don't think we'll be able to find out what they're doing. https://news.ycombinator.com/item?id=17749330
Which is not "complete control" and that was the point I was arguing against. That having source code access enables you to gain some control over your own life is not a point I was arguing against.
Additionally another point: even if you fork you can't keep that fork alive without manpower. Nowadays all the dependencies and apis change all the time as well.
It's very important to me that emacs is open source not because I review every single commit (I don't) but because it means that I can commit a lot of time tweaking and learning the ins and outs of the editor without worrying about having to switch to a different one a few years from now when the original devs get acqui-hired by Facebook and they stop working on their project.