Those problems are quite serious. A positive step is that they've been increasingly recognized as serious by people who develop and publish software, so there are significant transparency efforts underway now to try to make it possible to meaningfully tell where software came from, whether it corresponds to published code, and whether it's the same thing everybody else is using.

(Along with Mike Perry from the Tor Project, I gave a talk about some of these issues at Mozilla recently, which was pretty well-received. Tor has been very interested in making sure that compromises of their infrastructure won't compromise the software their users get, and that the developers can't be coerced into giving users backdoored versions; see Perry's "Deterministic Builds Part One: Cyberwar and Global Compromise", for example.)

To look at this from another angle, all of these issues are terrible gaps in software security, and terribly exciting opportunities for people to add backdoors (maybe more likely bugdoors), but now we have some tools and ideas that can start to address them!