Most apps are compiled straight from some dev's laptop with a largely undocumented environment consisting of many unvetted tools capable of injecting themselves into the build process.

But it's reproducible builds that scare you?