In this day and age of FUD, what are the odds that said open source software has a vulnerability or malicious code inserted by some state actor (ours included)?