I see this same kind of stuff in the LineageOS/Android ROM community, and it bums me out. It's like we're given a choice between 1) trust Google/Comcast/$BIGCORP with all your private date, or 2) trust some Macedonian teenager who compiled a binary somewhere. And of course, this choice is not even available to the non-technically-inclined (who frankly are better off going with Apple).