> but it's really not realistic for someone to audit every single line of code in every software to be guaranteed that nothing nefarious happens.

This is missing the point. Having the source code decreases the chance of having malicious software by allowing random people to read the code. Anyone can raise alarm if they see anything suspicious and it's easy to check such claims.