Eh, it's crap because you have to trust the company pushing it out, it's 100% impossible (by definition) to verify source yourself, at least not legally. You could trust an open source developer, but you could also have a look at the code yourself, or pay for an independent security review of it if your business depends on it.