You can verify the code yourself as open source. Also this is more about what Apple is saying it is doing, which I object to, and I feel is higher risk. But ultimately your point stands.
I think for more major open source companies, the code is inspected sufficiently. I would trust smaller ones much less. System 76 is fairly major, and most software comes from other major sources so should be inspected fairly well.
That's like saying Microsoft in the 90s/2000 could do no wrong because all eyes were on them. Or enron...
You could create a fund with like-minded people for the code to be reviewed. The benefit would be that for each subsequent release the cost would be much lower than for the initial one.
"I can't be bothered to verify Pop_OS so I'll trust macOS, which is IMPOSSIBLE for me to verify."
How is code written behind closed doors by a closed, for-profit company more trustworthy than open source code?
There is always the reasonable doubt, whether it's closed or open, but it's much easier to do nefarious or just _unspoken_ things when nobody except employees under NDAs have access to the source code.
The reason you trust Apple more than Pop_OS is simply because you've decided to have pretty much blind faith in their marketing content and PR speak. That's not to say Apple acts in bad faith necessarily, but blind trust in a blackbox doesn't make for great opsec.
Tech really drilled in learned helplessness on the masses.
It's not perfect by any means, but it's the best comprimise I've been able to come up with.
But hey, beeing free from big tech is very liberating. No distraction or social engineering through algorithm in feeds. But unfortunately you'll find out how hard it is to find what is going on around in your city, country... If you stay at home.