[jordigh]

> This means I am equally depending on the developer of the free software not to be malicious as I am the nonfree software.

You're typically not the only person who is capable of looking at the code. If there are malicious features you can, in principle, go and see what they are and disable them. More likely, you can depend on others to do it, or you can even hire someone to do it for you. These options are not even available with non-free software.

There is a further purely psychological matter. People are more likely to behave nicely if they feel watched. If they are publishing the source code, they are less likely to be malicious, because they know that anyone can, in principle, inspect their malice. This results in fewer malicious features.

In the case of Firefox doing things like Pocket or Hello or whatever, people can and do go ahead and replace Firefox with things like GNU Icecat or Debian Iceweasel that can remove these unwanted features. Or Firefox extension authors can provide extensions to modify almost anything about Firefox, a task which is facilitated by having access to all of Firefox's source code.