Also, in the specific case of the kernel, the auditor would only need to audit the subset of code they plan to compile and use. A lot of the kernel code is drivers and the auditor probably doesn't need all of them.