You don’t need a backdoor in the source code you chuck it in the installer or have it download via the package manager, hell chuck it in snap since its got proprietary code. Not saying that’s the case but there are many routes for installing a backdoor that aren’t so easy to detect