There's been plenty of cases where an app/package/extension has publicly available source code which differs from what's actually distributed.

However, I do see they have a section in their README regarding reproducible builds for verifying APKs against their source code.

I don't know that "hijack" is the right term here. Skepticism is very warranted. Whatever you think about Wikileaks' mission, their independence, transparency, etc... they have absolutely been used as an asset by Russian intelligence in the past. I think looking very suspiciously at anything they have to say about a conflict involving Russia is just normal prudence.

So much so, in fact, that I've actually seen the contra-conspiracy asserted: Russia made Assange/Wikileaks push this app precisely to drive Ukranians users away from it and into the arms of something else to which they presumably have more visibility.

I've been usimg the app for several years before Wikileaks tweeted about it, it's not like it came out of nowhere.

And the app is open-source, you can even compile it yourself.