You are just kicking the can down the road. Then the tool would be the same random exe attack vector. Even then, if the tool is designed to run random game code then the gamecode is still an attack vector.

Trust in software is a huge issue, but that is a totally separate conversation.

I understood that they'll release the source for the decompiled project, so you can build it yourself or compare hashes.

Of course it would be a lot easier to hide malicious code in such a decompiled mess of symbols.

Almost everything people use are exe's from the internet.