I don't know about you, but I seldom read through all the source code of the open source/free software I use. Yeah, even when I actually compile it myself.

If someone would slip in rogue code - it's quite likely some to many would actually run it and deploy it. Especially if it's a fast moving piece of software - like being so rapidly developed that distribution packages can't keep up for either time or stability reasons, leading people to compiling/deploying from source themselves.