I have always wondered about that myself. I guess I implicitly trust all the large orgs already using their products to do their due diligence, but if it is a targeted attack there is nothing much you could do.