[jmnicolas]

I work with C#, most (all?) Nugget packages I download are open source, which isn't the case of a lot of WP plugins that are obfuscated.

They're also centrally managed by Microsoft, so if there was a problem with one package they could kick it out of the Nugget repo.

But in the end you're right, it's mostly a matter of trust and finger crossed.