I for one think that this more of a matter of wishful thinking than a technical one.
It's IMHO a matter between trust and hope.
Do we really think that Google has complete control over the stuff they distribute?
Do we really think that a single person delivering some software outside of Google ecosystem is evil?
Judging these things is rather hard without some form of trust and hope.
And it's not something everyone can pick up seriously without the needed knowledge and tools.