And yet having the ability to look at source-code yields the greatest level of safety there is.

Apps without source-code cannot be trusted by default, unless you have a contract with the company providing it that stipulates a relief agreement that's reasonable for you in case anything goes wrong. And only enterprise software does that, depending on how you negotiate nonetheless, otherwise for consumers the EULAs are doing the exact opposite. And even with enterprise software guarded by good contracts, even then you need the source-code.

There is some additional food for thought in it when you realize that all life forms* are basically self-replicating DNA compilers. That is, compilers compiling compilers, which in turn compile more compilers. Thus, there's a chance some crucial information is actually stored "nowhere", i.e. is bolted in by complier which builds another compiler.

For more abstract take on this topic, I direct to Gödel, Escher, Bach; Hofstadter elaborates there on the fact that the distinction between what is data storage (e.g. music CD) and reading device (e.g. music player) is somewhat arbitrary, and in fact the information itself is "stored" in the combination of "data storage" and "data reader".

* - or at least most, IANAB.

These days it is - as long as that source code is in a language with multiple independent implementations.