No it's been trivial to make cracked unsigned binaries via disassembly for a long time. Only a 1 bit change is often needed to disable something important. It's unclear that anyone making malicious binaries with their keys will bother to setup a proper compilation environment.

With similar systems that intentionally support open source one can just switch to trusting some hobbyists keys instead of the compromised vendor. There's very little incentive for vendors to set that up correctly though.

Not really, no. Anybody can take an existing bin file, open up a hex editor, and modify it. Append another function to the assembled binary (or overwrite a rarely used portion of the file), change the destination of a JMP instruction, and you’re now executing attacker-inserted code.

Proprietary source code doesn’t provide any assurance of authenticity of the binary. For that, you need either cryptographic signatures (binary is vouchsafed by entity X), open source builds (binary behavior matches human-readable behavior in source), or ideally both (source is vouchsafed by entity X, binary behavior matches behavior of source).