He didn't say all open source is trustworthy, only that closed source is not. And Sourceforge, the repository itself is not open source.