No. Further, I'd stop drinking untreated water from all rivers. (Just answering your hypothetical. I spend a lot of time in the wilderness and wouldn't drink untreated water from a river or lake to begin with.)
This effect, though, has happened with software for me years ago. Enough bad actors exist that I've reached the place where I trust very few software houses (and I trust exactly zero SV-style companies). Not that all of those rivers are polluted, of course, but that it's impossible to tell which ones are and which ones aren't by looking at them.
I would never dare to start a business that depended on any of them. The risk is simply too great.
I may be stretching the limits of the analogy here, but either way that "verify, then trust" approach is more work than "adaptive blissful ignorance", and a lot of people aren't going to do it, or will at least slack off as the pain of the original incident becomes a more distant memory.
The only protection against this is contracts, but when a company -- like Unity has done twice now -- decides to retroactively change the terms of existing contracts, that means that you cannot trust them at all going into the future even if they're solidly "good" right now.
There's limited benefit to having the source code when the community has been splintered, and the future direction is contrary to your needs. Sure, you can make your own fixes, etc, but you no longer enjoy the leverage community development.
And that's still better than being stuck with arbitrary price changes.
Open source completely avoid this one problem. Apache-style development was created exactly for that.
You can complain that it's way overkill and a company doesn't actually need that level of assurance. But you can't claim it's not sufficient.
Without the concentration of diverse efforts that go into maintaining and advancing a project, having the source code (alone) is of minimal benefit.
It might be fine! Maybe on that particular day, somebody with cholera had just taken a shit upstream, and the bacteria are totally gone now. But it's still a useful prior, and that's the case here with whom you choose to conduct business.
I think it's a question of burden of proof. You'd ordinarily not worry too much about cholera, but after an incident you'd want the water thoroughly and repeatedly tested. You probably would not say "eh, it's been 5 or 10 years, it's most likely fine."
Similarly you'd want some concrete evidence that a company has actually changed, in a degree sufficient to offset your negative prior, before you'd consider engaging in any further business with them.
But actually doing that research is a pain in the ass, so I think it's a reasonable strategy to simply prefer companies that haven't screwed you over wherever good options exist.