> Also even if it is open source, who really verifies the binary is built from the source published?

Apple notarization is usually the way for non Store downloads. Non-notarized apps present a warning and require overriding security settings to run (with admin privilege). There's nothing inherently stopping someone from notarizing code A and putting code B on GitHub, only that some sanity checks have been performed and the binary is not a known threat (or has been modified).

https://developer.apple.com/documentation/security/notarizin...