It's not quite that simple. While the codebase is open source, the website could provide binaries that were not built from the open source code (e.g by patching to add tracking). So it is necessary to trust Muse Group if you're installing from the recommended source (which the vast majority of users will be doing).
Even if there is no tracking at the moment, there is always the worry that Muse Group will "go bad" and start adding tracking, or make the later versions closed-source, etc. One could argue that it's still better than a fully closed source company - sure - but what happens to Audacity/MuseScore then?
Reliance on a single company developing code has huge benefits: as discussed in this video, the centralisation really helped with vision and planning; but it does make me slightly uncomfortable. The development is no longer "open", in the sense of community driven. The application now has a different goal (to make money for Muse Group), not necessarily aligned with what users want/need. It cuts to the core of what we actually want from free software - lack of profit motive? transparency? Of what exactly?
It cuts to the core of what we actually want from free software
Mostly people want free as in beer and actual users of Audacity use Audacity because they want to process audio.
it does make me slightly uncomfortable
Then you have a choice to make. There are many other audio software packages with a variety of tradeoffs to choose from because everything is not for everyone.
make money for Muse Group
To me the strategy appears to be that strengthening the two open source projects (MuseScore and Audacity) enhances their many commercial offerings…for example a stronger MuseScore is better for Hal Leonard Publishing particularly in light of the demise of Finale and a better Audacity code base is a good way to develop the audio code that other Muse Group products need anyway.
And for what my pure speculation is worth, the purchase of the trademarks for Audacity and MuseScore could rationally contain conditions underwhich Muse Group would have to sell those trademarks back to the original owners.
But even absent such conditions of sale, the original trademark owners likely trusted Muse Group to do the right thing (and if the sale was just about money, then the original trademark owners were already mercenary themselves and so whatever trust you previously had was already misplaced).
While the codebase is open source, the website could provide binaries that were not built from the open source code (e.g by patching to add tracking).
That is a violation of GPL.