Why do I get the nagging suspicion their 1 million LOC codebase is backdoored?