Someone surely is doing regular thorough security audits of nginx, yes. Even at maximal cynicism, discovering a backdoor in its source code would get someone niche fame and a job at Project Zero (or a nice windfall on the black market, I guess).