What’s the point of downloading the binary if you’re going to compile from source yourself anyways?

Is the expectation that only a few users (watchdogs) do this and everyone else benefits from the extra validation?

That model has been proven for cryptocurrency, hasn't it? As long as you have enough validators, you don't need everyone to spend the considerable resources it takes to validate (or in this case, build from source).

Right now the Apple model is "trust that the Apple employee who glanced at this for 15 minutes spotted any problems".

How do you know the source hasn’t been tampered with, or outright backfired by the author?

I don’t think any distribution mechanism will solve the “how can I trust these bytes I got from the internet” problem.

Ideally the source is readable, though reality falls short of that for most projects.

For example, I didn’t realize I liked C until Redis. Now I’ve found a handful of C programs that I’d put into the “readable by non-C devs” bucket, like i3 and the suckless collection.

Most build tools also are a disaster from the perspective of giving end users agency over their software. Automake, make, etc are often cryptic magic to non-practitioners. Like C, they can be made readable but most aren’t.

KISS Linux falls into this bucket of “grokable” as well, it’s minimal and the process of going from source to distribution is easy to understand. Many stock distributions are so complicated I don’t think the average tech-savvy human has any hope of truly understanding what their system is doing in a single lifetime.