*shrug* It's not like it's difficult to hide malicious code in source packages.
After the damage is done, probably easier to find the malware that did it if you can rely on the source code being an accurate representation of what was running (not that this would be any easy task).