Yes, but sometimes software comes from people who are generally trustworthy. Free and open source software from official Linux distribution repositories has a very low chance of being compromised.