There is a false assumption about Open Source Software:
"The code is publicly available to anyone, domain experts can check it out and verify for the users, therefore it is safe for everyone."
The truth: Code is checked in most cases but coward attacks (such as CC vulnerability) stay uncovered until it is exploited. Then experts show what's wrong.
What's needed: A registry of independent code reviews on critical software by known experts signed and verified.
