Reproducible builds help here. Not all clients are supported yet I give you that, but perhaps you can see how far injecting backdoored clients on mass scale is from "user's sending plaintext copy to server every time". Both achieve the same thing, one will fill the headline of every news paper in the world if it happens once, the other happens right now, billions of times a day, and nobody cares. There's no perfect verification process, but there's a metric fuckton of low hanging fruits we need to address first.