GNU Mes tries to avoid this by bootstrapping everything.
https://guix.gnu.org/en/blog/2023/the-full-source-bootstrap-...
This gives the level of auditability and transparency that we desperately need.
However, the same problem of "yogurt software" manifests at higher levels of the stack, typically with compilers and build systems, some of which still cannot be built from source (GHC and Bazel come to mind).