[progval]

> yet no-one was even doing the easy bit (auditing the source code).

Someone did: the Fedora maintainer who raised the issue. One of the reasons I avoid installing from wild-west package managers like Cargo/NPM/..., is specifically because Debian/Fedora/... maintainers performs some basic checks like this so I don't have to.

[worthless-trash]

The fedora/rhel builds also go through virus/malware / security checks as part of the release process.

Each exception needs to be documented and specific.