The problem is so much of what we use is not a community effort but the work of a single person in their free time unpaid. So you might do a big review of all the things you find weird and then the maintainer will say "eh, I don't have the time or desire to rewrite all of this" And fair enough, why should they accept all this extra unpaid work.

I'm not sure what the solution is but it probably involves companies getting more active in the development of all the stuff they depend on especially when its not some mega project like linux or postgres.

Sure, I understands your point. My fear is untrusted code executing on my machine. It wasn’t till I ran a tcp dump that I realised my terminal (KiTTY) decided to ‘phone home’ to ‘check for updates’ - I manage everything through apt, and a terminal by nature executes code so I view it as high risk and don’t really like this behaviour.