As a software user, you can either care about your privacy or not. Caring about your privacy and not either vetting what you’re planning to use or checking that someone else has before using it, is akin to sticking your hand in a fire to find out if it’s hot.

Taking that analogy further, malicious open source software is kind of like a burning building. It only takes one person to raise the flag for it to spread pretty quickly through social media or other means that it is malicious. The whole community doesn’t need to acknowledge the fire for something to be done about it.