I agree its a concern. You could argue everything on XDA forums and any modified Windows should have the same problems.
Personally I use the community of version of Arch i3, not going to check the source on that, but will trust that community might keep an eye on anything nefarious.
Doesn't seem like Linux is completely immune from that either(i.e. XZ Utils).
But the build is amazingly stable and fast, and I will have to take it good faith that they didn't do anything that would harm me.
I can at least track down the author in various communities and seems to be semi-open about their identity. There is a forum thread any concerns I can bring up with the person responsible.
They are also taking donations. I would hope that exposes them to some liability and financial trail if they are found doing something illegal.