I trust the package managers to build software in a way that I can be sure matches with the published source package. That&#x27;s the important difference. Projects bundle blobs into their binaries that aren&#x27;t in the source code all the time (cf. chromium as discussed, but firefox did (does?) this too).<p>Of course you could say in a large codebase like chromium, bad things can be hidden. But at least there&#x27;s a better chance such things are found, and it&#x27;s more risky to put it there in plain sight.<p>In a perfect world, all software would have reproducible builds and there would be no issue with trusting that binaries contained no hidden functionality not in the source, as there&#x27;d be third parties to rebuild and compare the result against the published binaries. We&#x27;re a ways away from that.