I don’t think we must build a top notch audit company. Probably most of us use dApps already, and having any “trusted” look at the code is better than none. Also, as much it might be hard to locate a sophisticated back-door by creators, it is relatively easy to spot an upgradebale proxy and multisig owners (which are often ignored by audit companies as this works “as designed”). This, and general overview of the code I can do myself, as I do it anyway for my personal sense of security.