"It's open source, someone surely is doing regular thorough security audits."

Auditing one of the world's most used pieces of internet facing software that also isn't "a huge codebase"? Yes I do think nginx will be just fine. Security experts are constantly combing through that sort of software looking for holes, as well as AI tools. duh. It ups your brand to find holes.

Counterpoint: https://en.wikipedia.org/wiki/Heartbleed - 2 years is a long time

Someone surely is doing regular thorough security audits of nginx, yes. Even at maximal cynicism, discovering a backdoor in its source code would get someone niche fame and a job at Project Zero (or a nice windfall on the black market, I guess).

the thing is: you have to introduce very subtle bugs when the code is open. And if you exploit it in the millions someone is going to notice.

Indeed. If, as suggested, a backdoor is planted by something like a three letter agency they're not going for mass surveillance or "hacking all the things". It's a very valuable asset that you use wisely, maybe even just once if the target is worth being discovered afterwards.