I mean, supply chain attacks are a thing that could have happened even in the earlier days. Linux almost got backdoored in 2003.

Also with the number of remote code execution exploits that have occurred in Web browsers over the years it's hard to know for sure if what you installed hasn't been hijacked unless you spent all your time on gnu.org