I couldn't care less if they are actually tankies, just keep developing the code and don't try to inject malware (well it's open source they can't lol), believe whatever you wanna believe, I don't care.

but they can write malware and commit it to their repos.

the question is how long will it take for someone to recognize it. ie.: how well obfuscated is it?

not saying they gonna do it, just that doesn't trust any code just bc they are open source