The guy on Codeberg or Forgejo might have less resources to hide something, and probably wouldn’t dare. The bigger the companies, the more people involved with the resources to make tracking software look like regular data requirements.
If you employ something with hundreds of hours of code you’re less likely to see backdoors. Look at a simple program and any kind of odd insertion stands out immediately.