Yep... well that's what free software and open-source is for. You can't trust corporations so you MUST have the actual code. Harsh lesson but at least if something is learned and the mistake not repeated, that's OK.
You need at least:
1. A Copyleft license
2. Rights staying with the authors, no CLA, no Copyright assignment
3. A diverse enough set of truly independent contributors to reliably prevent collusion.
Bonus points if everything is held together by an organization that operates for the good of the public (and not only its members, 501(c)(3) > 501(c)(6)).
Good examples are Linux, Git, Inkscspe and QEMU. Notably all software from the 90s or early 2000s.
FTFY. Free software is the user-freedom fork of that concept, while open source is the developer-corporation-freedom fork.
Nothing against you personally but that kind of logic is getting old. I get it that you don't trust corporations but asserting it like open source projects don't do rug pulls, and like having the source because you can spin up the version you even if they screw you over means it's safe is missing the point of how we all function as a society.
The problem isn't open source or corporations to begin with or someone made the mistake of trusting someone who seemed trustworthy to begin with, and people who take the opportunity to push their own beliefs and narratives by capitalizing on emotional situations like this instead of finding constructive ways to make things better are the worst.
The big picture is that agency was lost and that's not OK.
*can* is a lot better then *do*. I would prefer that all of these processes be documented such that new sources of these products and services can be created if need be. That's really what having the source for a given piece of software is; the documentation required to reproduce it.
Imagine if the process of generating electricity was a big secret and controlled by a single company. That company would be unreasonably powerful, no?
I trust corporations enough that i do pay them to provide me with goods and services. I do not trust them enough to set them up as the only viable source for goods and services.