[nightowl_games]

That's not a sufficient level of trust. The author should basically never be trusted and it's extremely difficult to verify that the source of what's available is the same as what's in the binary that you downloaded.

Just look at the xz backdoor... "Author trusted"...

[realusername]

I will always prefer "trust the developers" Linux model to "trust the manufacturers" that you have on mobile.

Sandboxing just puts the problem one level higher and doesn't remove it.

Then on the subject of the xz backdoor, nothing is safe from that kind of attack.