Yes, that's what I mean, at the end of the day, you have to trust somebody / something.

Here you have to trust both developer's code and Google's build system. Can you verify all of the developer's codes? And can you verify how privacy-trustworthy Google's build system is? At the other side, you have to trust developer's code and developer's build.

I didn't mean which one you "should trust more" at all in my comment above. Please read again. What I mean is the first sentence here.