They’re pulling info from all the other search engines, not just DuckDuckGo. FYI DuckDuckGo is also pulling their results from other search engines, the only difference is that DuckDuckGo aren’t being blocked/rate-limited by them, presumably because they’re paying for API access.

If you hosted your own instance then it would be a lot more reliable since the IP wouldn’t send a suspiciously high amount of requests.

As for your trust argument, I couldn’t disagree more. You choose to trust DuckDuckGo, who happens to be closed source, because of their branding. The same way people trust/trusted Google/Apple/etc. because of theirs. This thread is a perfect example why being open source is the most important thing for any privacy service (because otherwise this privacy leak likely wouldn’t have been discovered, and people wouldn’t have known that the company so carelessly violate people’s privacy and fail to correct it when people point it out.. it should really make you wonder what’s happening in the search engines codebase).