Thats where reproducible vuilds come in - I would not be surprised if reproducible builds became a legally enforced default in security sensitive contexts after all the high level cases of outside attackers slipping mallware into blobs built by enterprise vendors.