> Someone somewhere is bound to notice fishy behavior at a certain scale.

I'm not convinced that this is true to a meaningful degree. It's certainly theoretically true.

However, we've now had a number of events where bad things were found in fundamental and popular OSS software, and those things existed for years or even decades before being found. And who knows how many more exist that haven't been found, or at least publicized, yet (and may never be).

I think the reality is that most devs aren't deeply examining the tools and libraries they use. How could we? We'd spend all of our time vetting software and little time writing it.