I was thinking more about the users on Macs and Windows who use open source software..

The risk is not in the sources, but in the server which hosts the installers. A hacker could just build the software from sources (adding his backdoor) and replace the original installers with his own.