Changes are not made at will, they are submitted and have to be accepted by the project leader usually after being analyzed, both for bugs and intentional attempts to create vulnerabilities.
This is an excellent point - some open source projects like the Linux kernel (or adjacent projects) are populated by industry veterans and open source champions. They are very good at what they do.
Some of the fediverse projects are run by a handful of hobbyists and tinkerers, some are handled by a single project leader, others still by a single developer. Such projects are acutely vulnerable to malicious contributions disguised as assistance. A quite literal Trojan Horse.