Actually you can't guarantee even that given the profitable black market for user data in Russia (it's easy to sell and buy leaked or stolen data there)
Not everything in Linux have a source code available for users. And you may want to use i.e. Chrome, or some games, or some drivers by i.e. NVidia. And that without counting BIOS or whatever deep down computers use, most of what you could use as social network/mail solution, and not found yet trojans like what happened with xz in some basic tool.
Having the source is a good start, but having a "lawful" powerful active player that actively want to intrude should be part of the equation. It was a formidable threat a decade ago, nothing was done about that, and now is even more advanced than what was then.