In general I would expect a mixture of two things: since this is an open source project, it should be building those things from source (even if that source isn't in this specific repo), and/or [related to that one] if it has dependencies upon pre-built binaries then put those in the build script so a reasonable person could audit both what's in that .dll and where it came from. In this specific case it seems like it came from some rando spam site without any idea what is actually in the .dll

This situation seems to be on brand for a repo that has a file named malware.c but I am addressing the general case that you asked