I think the concern isn’t plainly installed spyware, but rather zero day vulnerabilities. However, it’s not like you need to own the project to introduce them, or discover them and wield them. At any rate, open source is the best way we can attempt to create secure software.