That's the whole point of these projects - they're preventing that type of attack.

If you implement your bootstrap C compiler entirely in machine code for instance, it doesn't matter if the "original C compiler" is compromised, since it's not being compiled.