Why does having control over the code matters when you can review the code? The argument you make is like Microsoft during the 90s when supposedly anybody can sneak malware into an open source codebase, which just isn't true because of reviews.