I may be stretching the limits of the analogy here, but either way that "verify, then trust" approach is more work than "adaptive blissful ignorance", and a lot of people aren't going to do it, or will at least slack off as the pain of the original incident becomes a more distant memory.
The only protection against this is contracts, but when a company -- like Unity has done twice now -- decides to retroactively change the terms of existing contracts, that means that you cannot trust them at all going into the future even if they're solidly "good" right now.
There's limited benefit to having the source code when the community has been splintered, and the future direction is contrary to your needs. Sure, you can make your own fixes, etc, but you no longer enjoy the leverage community development.
And that's still better than being stuck with arbitrary price changes.
Open source completely avoid this one problem. Apache-style development was created exactly for that.
You can complain that it's way overkill and a company doesn't actually need that level of assurance. But you can't claim it's not sufficient.
Without the concentration of diverse efforts that go into maintaining and advancing a project, having the source code (alone) is of minimal benefit.
No. Further, I'd stop drinking untreated water from all rivers. (Just answering your hypothetical. I spend a lot of time in the wilderness and wouldn't drink untreated water from a river or lake to begin with.)
This effect, though, has happened with software for me years ago. Enough bad actors exist that I've reached the place where I trust very few software houses (and I trust exactly zero SV-style companies). Not that all of those rivers are polluted, of course, but that it's impossible to tell which ones are and which ones aren't by looking at them.
I would never dare to start a business that depended on any of them. The risk is simply too great.