There's a lot of work that goes on both before and during that "just".

Bugs can exist even in code most of us would consider trivial. The Tor daemon is definitely not trivial, and the project itself points out that it needs work![1]

Here[2] is "just" container.c from the Tor project. It's one very small part of the project that does fairly simple things any professional developer ought not have much trouble understanding.

It's almost 1600 lines. Are you telling me you can guarantee there are no bugs of potential security significance in that file?

They also want to make Tor even more multithreaded than it already is[3]. Threaded code never has bugs, right?

Any software is a potential attack vector. Tor is no different.

[1] https://www.torproject.org/getinvolved/volunteer.html.en#tor...

[2] https://gitweb.torproject.org/tor.git/blob/HEAD:/src/common/...

[3] https://www.torproject.org/getinvolved/volunteer.html.en#use...