The root code is open source. That's how they found the issue.
We always encourage our users not to (just) trust ZeroTier, not because we don't think it's safe but because you should never trust just one thing. Never, never, never. One layer of security is no security.
There are people who will tell you their software could contain bugs. Then there are people who will lie, or who are delusional.
Anything you care about should be gated by at least two security systems, preferably ones with different code bases from different vendors. Bonus points if they use different mechanisms or algorithms.