people are definitely going through the code on a project as popular as audacity…
less well known stuff is much less scrutinized, of course

Its way less work than going through the code to check for telemetry unless it is an intentionally hidden attack- just use Wireshark and check if there is network traffic other than checking for an update on program start.

If a project is popular people will make changes to it every day. But you can look at the repo and judge for yourself.