Not that there aren't trust issues with bigger projects but don't folks worry that the further down the "branch of a flavour of of a branch of a flavour" chain they go the higher and higher the risk of someone sneaking nefarious code through becomes? I guess there's a natural barrier in that the lesser known code bases become less of a target.

Sometimes I just find it wild with how much we talk about containers and sandboxes for the user space code we run that there's still regular recommendations for the random distro of the week published by who knows who.