Open source software can definitely be tampered with if the maintainers aren't vigilant enough. Look at what happened with XZ/LZMA debacle a few months ago. Yeah it didn't make it into most distros but still...

And the sad reality, the maintainers for most useful OSS projects are essentially paid employees of a company. Which can be easily enticed/forced by governments.

And then there's the hardware manufacturers. Even the most hardened software running atop compromised hardware becomes worthless.