I think you don't need to trust the server just if you can audit the frontend and assure it does not share any sensitive information with the server-side. If they apply the concept of data minimisation, decentralisation and distribution properly, there are fewer risks involved.

But, if the server manages sensitive information, yes. It is preferable to audit the server code to understand how they handle the lifecycle of the information.

"If you think you need to see the server source then any trust you have is mistaken."

Sorry but I don't agree. I trust in systems I can verify. Trust without verifying is not trust, it is faith.