My judgement says not to execute programs I can't read the source to or hold the publisher legally accountable for.

But you don’t read the source to most things, no? Nor do most people.

Isn’t that why things like heartbleed took two years before being found out? I presume some people using the vulnerable OpenSSL versions felt similar to you.

Being open source does not ensure software is bug free but its highly highly likely to not be malicious. Usually malware authors don't actually write software, they tack it on to other peoples software or write stuff that doesn't do anything useful at all. Not once have I ever heard of malware making its way in to the debian repos.

The worst I have seen is xscreensaver embedding a message in the code to complain about the old version a year after release.